Wyze Cam Notes

A year or so ago I bought a Wyze Cam to try out. I’d wanted an IP camera for a while, but with the exception of a ~$15 Gearbest special, I’ve deemed them all too expensive to experiment with. The Wyze Cam was different. It had a good reputation, and was available for $20 + shipping. So, I bought one. My first impressions of the hardware and image quality were favorable, the software, less so.

It’s clear to me that Wyze was trying to differentiate itself on a combination of low price and ease of use. They focused on a few simple scenarios as a route to ease-of-use. The Wyze Cam wasn’t/isn’t a typical security/surveillance camera, intended for watching home and exterior property. Instead it was more a personal, indoor surveilance camera. The Wyze Cam debuted as the sort of thing you could use to check in on your child sleeping or playing elsewhere in your house, or see which of your dogs was knocking stuff off the kitchen counter.

The software, both the camera firmware, and the smartphone app needed to access the camera, was basic, but capable enough to serve these scenarios. The camera firmware could identify motion using crude techniques. The firmware used the motion detection capability to trigger a cascade of events. Motion triggered the camera to upload 5s of video before the motion was detected and 5s after to Wyze’s cloud service. It could also store the same video locally, if there was an SD card on the camera.

Their cloud service can send notifications of new video clips to the smartphone app, from which the stored video can be viewed. The app also allows viewing of the live stream remotely over any Internet connection, can view video stored on a self-provided TF card in the camera itself when on the local network, and also allows viewing of video clips stored in the cloud over the previous two weeks.

Wyze was successful in delivering these basic features, but the overall experience was a bit clunky. Getting the camera connected to my local WiFi was relatively painless, and once connected, access when I was away from home just worked (except for a few occasions when it didn’t work at all). Accomplishing things in the app often took more steps than seemed necessary and some actions were hit-or-miss.

The (free) cloud service also imposed limits on how often video clips could be uploaded, presumably in order to manage the cost to Wyze of offering the free service. After a clip was recorded, the camera waited ~10m before motion could trigger recording of a different clip. This would probably be fine for keeping watch on the interior of one’s home while away at work, or vacation, but, combined with other limitations made the camera considerably less useful for keeping watch on the outside.

The camera firmware allows some coarse tuning of the motion detection. You can adjust how much the image has to change before triggering. You can also limit motion detection to a (rectangular) subset of the camera’s field of view. The utility of these limited settings really depends on the specifics of the scenario you are trying to accomplish. If you want to keep close track of who visits your porch, you can limit the motion detection region and turn the sensitivity down enough to minimize false positives from car headlights, the sun going behind a cloud, or moths flitting around, but then you loose any utility for seeing who is leaving dog crap in your yard.

Another limitation is that browsing the video stored locally is clunky. There is no way to scrub though in faster than realtime. You just have to jump forward manually and wait for the network to catch up. If you want to see more than 10s around a motion event you have to take note of the time of the triggered event, then switch to viewing stored video, then navigate to the proper time — there is no shortcut to jump from a stored 10s to the same time in the locally stored continuously recorded video with a single tap.

These limitations were enough that I stopped using the camera and just left it running on the assumption that if some event was severe enough, like, say, an animal sacrifice on my front lawn, I might go to the trouble of trying to find and view whatever the camera captured.

That assumed that the camera captured anything at all. I had trouble with the camera crashing or loosing track of the TF card and not recording video again until I noticed and rebooted the camera, and/or ejected and reinserted the card.

There have been some other severe annoyances, too. You have to log-in to Wyze’s service to use your camera, even though the only scenarios that require an account are sharing access with another person. Worse, the login expires after some number of days without use. Once your login expires the app doesn’t take advantage of FaceID on iOS for a quick login; you have to type your password in.

Recently, after more than six months of disuse I decided to try the camera again — I’d grown fed-up with people leaving their dog’s bagged crap in my waste bins, particularly when they put it in the recycling or yard waste bins.

Logging in to the app is still more tedious than it should be. Some operations are smoother and less hit-or-miss than they were, but I still find that a number of actions take more steps than they really should.

In the end, the Wyze Cam didn’t catch anyone in the act, but it did catch someone behaving like someone might if they were about to put poorly-bagged dog crap in my yard waste bin before the clip cut out.

It’s still tedious to review the continuously captured video from the TF card. Pulling the TF card is difficult, because of where and how the camera is mounted, so I’m limited to using the clunky, slow UI in their iOS app. I can’t download an hour or days worth of video quickly to my phone for easier/faster review using a native UI on my phone or computer; I can only “record” the stored video in real time. — if I want to download an hour worth of of video, I need to start “recording” in the app and leave it running for an hour. Ridiculous.

Wyze has made one major improvement since I first got the camera, though. Earlier this year they added “person” detection to the firmware, using software licensed from a third party. Once enabled, it works by waiting for the camera to detect motion, then software running on the camera does further processing to see if the captured footage contains a human being (generic). If it does, the captured clip is marked as containing a person. Notifications can then be limited to clips that contain a person. The list of captured clips also notes whether or not a person is detected.

I want to underscore a few important details about the person detection. First, it runs entirely on the camera, which means that it isn’t being used to help train some big tech companies Artificial Intelligence brats, like some sequel to the Handmaid’s Tale (unless you submit clips for review on an individual basis). Second, doesn’t identify specific people, just the presence of a generic human being.

The accuracy is quite good, too. I’ve seen very few false positives (detected a person when there is no person) or false negatives (didn’t detect a person when motion was detected and there was a person in-frame).

The motion detection works well-enough that I’ve turned on notifications. At this point, though, more than half of the people detected are walking by with dogs, which isn’t something I need to know about right away. I think i’m going to adjust the motion detection region and limit it to my porch. I won’t be able to use the camera to catch dog crap offenders, but it’ll be good for checking to see who is at the front door, and what packages have been delivered.

Wyze does still have the option of making their camera useful for outdoor surveillance. My understanding is that the crude motion detection is a result of the limited motion detection support provided by the SoC (system on chip) and the SDK the manufacturer provides. The SoC isn’t very powerful, but the fact that it can run person detection algorithms in near realtime means that it is powerful enough to do simpler image processing. It should be possible to filter motion detection through non-rectangular regions, and/or adjust and apply the detection sensitivity on a region by region basis. It should also be possible to better filter false positives caused by insects attracted to the camera’s infrared illuminator LEDs at night.

For $20, Wyze Cam is an interesting product, and it is even a useful product for some scenarios. If my dog was still living, I’d probably have a few Wyze cams just to see what it does when we aren’t at home and it wasn’t sleeping. I may be picking up a few more Wyze Cams soon though, because we’ve started thinking we might be ready for new dog.

Solar Panel Notes

I’ve been tinkering with a small, semi-potable solar setup and have an eye to upgrading it. These are my notes. My facts my be incorrect, they are certainly incomplete.

My system is currently configured as:

  • 18W, 18v flexible Sunpower panel.
  • CN3791 MPPT charge controller
  • LiIon battery pack(s) made from 1S20P Samsung 28A 18650 cells. Configured as two packs of 1S6P and one pack of 1S8P, each with a cheap protection board. Estimated capacity is ~150Wh
  • ~15W 6v folding, portable panel, made from Sunpower cells. I’ve added a bypass for the buck converter that supplies regulated 5V USB so I can use it with MPPT controllers.
  • 21W 6V folding, portable panel, made from Sunpower cells. I’ve added a XT30 connection so I can swap in different loads, including the original 5v USB buck regulator, a different buck regulator, or an MPPT controller.
  • These folding panels are hooked up parallel, they are connected to another CN3791 MPPT charger.
  • Both chargers are connected in parallel to the battery bank. This could have some weird effects, particularly as the pack reaches 4.2v and goes into constant voltage mode.

The panels are not optimally deployed. They are lying flat, and due to trees, etc, only get unobstructed sun for ~4-6 hours a day. In this arrangement, peak power for the 18W panel has been about 10-12W.

The 6v panels are even more suboptimally deployed due to sitting on the floor of a window platform for cats, which means they are obscured at times by the frame and even the 18W panel which rests above them.

I also have a laminated ~6W 5V Sunpower panel that is currently unused. It originally had a buck regulator to power USB devices, but I removed it and replaced it with a quick release terminal so I can use it directly with a battery charger.

I’d like to move up to 100-200W of panel capacity before a new wave of Trump’s dumbass tarifs hit. Options in consideration:

  • Rigid mono or polycrystalline panels.
    • Polycrystalline is currently slightly cheaper per nameplate wattage, but maybe not enough to be compelling. Currently <$1/W.
    • Pro: Cheapest option. Con: Since I’m not making a permanent installation, the fact their weight and fragility of the glass is a concern.
  • Flexible panels. Lots of options, most of them dubious.
    • The cheapest flexible panels are available at a ~20-50% premium over rigid panels.
      • Use PET encapsulation on the sun-facing side, which isn’t suitable for constant environmental exposure.
      • Use cell constructions that don’t hold up to flexing and don’t deal well with microcracks that develop in the silicon wafer due to flexing.
      • Use panel interconnects that won’t hold up to flexing.
    • Quality flexible panels are 2-3x as expensive as cheap rigid panels.
      • Use EFTE top layer for long life and durability.
      • Use primarily Sunpower, but occasionally Day4 or Merlin cells which are well suited for the challenges of flexible substrates.
      • Use rugged, flexible interconnects.
    • Folding flexible panels.
      • One, common variety uses ~6v, 7W subpanels connected in parallel to power a 5V USB buck regulator. The subpanels are made from twelve Sunpower offcuts in series. These are typically encapsulated in PET and sewn into ballistic nylon covers with cardboard for added stiffness. Newer designs use EFTE and may forgo the fabric construction a fully laminated construction and a panel thickness of 2-3 millimeters..
      • $1W at the low end, >$2W for branded products like Anker or RavPower.

Background Information

  • Panel Basics
    • Solar panels are constructed from multiple photovoltaic (PV) solar cells in series.
    • A typical PV solar cell has an optimal voltage of about 0.5-0.6v, which is determined by the bandgap of the doped silicon junction.
    • The number of cells assembled in series determines the panel voltage.
    • Panel voltages are generally matched to their intended application.
      • Six cells in series (6S) are well suited for 3V electronics of the sort powered by two Alkaline cells in series or a single lithium metal cell (like the ubiquitous CR2032 button cell.
      • Ten (5V) to twelve (6V) PV solar cells in series are typically used to charge/power 5V USB devices by way of a buck-converter voltage regulator. These configurations are also well suited to charging Lithium Ion batteries, which are used in smartphones and most other battery-powered devices that can be charged from USB.
      • Panels made from 32-36 cells in series are common. They have an optimal voltage of 18V, but are often labeled as 12v because they are used to charge 12v lead acid batteries without a regulated charging circuit. The are also used with LiIon batteries in conjunction with a suitable charging controller. ~100W, 18V panels are often connected in series for higher-voltage and higher powered systems, including AC systems
      • 150-300W panels with 50-72 PV cells in series are also used in larger installations.
    • Panel Construction
      • Panels are assemblies of multiple, electrically interconnected, solar cells. They protect the component PV cells from the elements, and provide support when deploying and mounting the cells
      • Rigid
        • Framed Laminate panels sandwich the cells and their interconnects between glass and a sturdy backing material. The laminated panel is then held in an aluminum frame to enhance rigidity, provide protection, support and points of attachment for mounting the panel.
        • Cast panels are typically under a few watts of power. They seal the cell in protective epoxy or another cast resin.
      • Flexible
      • Laminated

GL-Inet GL-MT-300Nv2 Power Consumption

Today I updated the firmware on my GL-Inet MT-300N v2 “Mango” travel router, and while I had it out I decided to measure its power consumption.

For those who don’t know, a travel router makes it easier to securely use a temporary internet connection, like that provided by a hotel, and share it among multiple devices. The hardware specs on the GL-MT-300Nv2 are modest, but sufficient, it is compact (about the volume of a deck of playing cards), and inexpensive ($20.49 on Amazon). The firmware is based on a recent release of OpenWRT with a UI optimized for use as a travel router. For those who want it, the standard OpenWRT Luci interface is available.

I decided to test the power consumption because my tiny solar power station (~18W panel, 120Wh LiIon battery), was generating more power than it could store and I’d already finished charging my phone for the day. As I unplugged my phone’s charging cable, I noticed that the USB-powered router was right there, so I plugged it in instead and reset my USB power meter.

Once the router started up and I connected my laptop to it over wifi, I noted the power consumption was about ~1.3-1.5W. I ran an Internet speed test from my laptop and the power consumption bumped up slightly. After an hour, the cumulative power consumption was ~1.4Wh. I connected the router to ethernet to see if that made an obvious difference in the power consumption; it didn’t.

Based on these crude measurements, I think it’s safe to say that the GL-Inet GL-MT-300Nv2 uses less than 2W on average. That means that, if necessary, it could run for >3h off a typical small USB power bank, and could probably run directly off a ~$15 6-7W solar panel with USB output through most of a summer day.

I didn’t check the power consumption while using the router as a VPN gateway, which is probably the most CPU intensive use of a travel router. The manufacturer’s specs for power input are 1A @ 5v, which works out to 5W, so thats the limit on peak power draw, and would only be reached during the peaks of VPN use. Peak VPN speeds are in-turn limited by the CPU’s performance, which limits peak VPN speed to ~10Mbps.

$2 Bluetooth Tracker / Finder / Tag Teardown

Some research into the present and near-future state of indoor locating technology led me, inevitably, to Bluetooth Low Energy (BLE) beacons. Bluetooth Low Energy led me, inevitably, into a short digression into Bluetooth “tags” for finding lost items like keys.

I just received a couple such tags I ordered from AliExpress for less than two dollars, each, and I made a video showing what’s inside when you open them up.

Yeah, I misspelled “bauble” in the title sequence.

These Bluetooth tags for finding lost items appeared on the market at about the time that Bluetooth Low Energy (Bt 4) started appearing in the latest smartphones. I don’t know who was first on the market, though I’ve seen the suggestion that the idea may have originally come from Nordic Semiconductor, one of the biggest companies dedicated to making chips for low-powered RF applications. I do know that Tile is probably the dominant vendor at this point.

The basic Bluetooth key finder “tag” is a small device, the size a condom packet, or a matchbook that can be carried on a keychain. Inside there is a small circuit board with a Bluetooth SoC (system on chip), a microswitch, battery, a pezioelectric speaker, and a few supporting components.

When it is powered on, the tag transmits to “advertise” itself. When it is advertising itself, a companion app, running on a smartphone can detect it and connect to it.

Once connected, the app periodically checks the signal strength of the tag. If the signal drops below a preset threshold, or is lost entirely, the app will notify the user, allowing them to stop what they are doing and find the object before they become too far separated from each other. The tag may start “chirping” automatically to make it easier to find. If the user needs help finding the tag while still nearby they can also use the app to instruct the tag to start chirping.

The system also works in the opposite direction. If the user is carrying the tag on a keychain in their pocket or purse, then the automatic chirping will warn them that they’ve become separated from their phone. If they realize they can’t find their phone when they are still nearby, they can also push the button on the tag to trigger a sound on the phone in order to make the phone easier to locate.

This basic functionality seems enough to be useful to people who loose track of things a lot. At this point, its available for less than $2, if one knows where to shop. For that price, one gets a functional but crummy app. The app may have added functionality, like the ability to use GPS to map the location where the phone was last able to communicate with the tag. This could be useful to determine you left your keys at the gym, rather than the office.

Tile, and others have gone further, in order to justify charging $20, rather than $2, and also to enhance their competitive position. If you use one of Tile’s tags, then, if your tag and your phone become separated, Tile’s app, working with their backend system, can check to see if any other Tile user’s phones “see” your tag, and then let you know where.

This tag-finding network sounds clever, but I wonder how well it works, and how useful it really is, particularly given the potential privacy concerns. It’s certainly possible to implement in a way that preserves privacy. In fact, Apple recently described the outlines of one such system they are developing to help people find lost or stolen Apple devices, extending their “Find My” app from iPhones to Apple Bluetooth devices, like AirPods, and also beyond WiFi range for Macintosh computers.

Apple is also rumored to be working on their own Bluetooth tag to allow keys and other objects to be tracked by the system. This might explain why Tile has recently partnered with a number of Bluetooth silicon makers, including Nordic, to extend the Tile network to third-party devices.

Back to the $2 tags I took apart, a few things of note:

The first has a teardrop-shaped case. The printed instructions point to the cTracing app. It shows up as “ITAG” using a general purpose bluetooth scanning app. Inside, I found a model XTR-FTQ-3432 PCB with V1.2, dated in 20181105. The SoC is from a Shanghai design house called Beken, and the part is BK3431.

Back in 2015, Brian Khuu tore down a tag that used the same case. His tag came, packaged for retail, in a box labeled iTag. Inside he found a different IC, labeled as ST17H25. One of the commenters identified it as a Telink TLSR8266 F512. It is actually a Lenze ST17H25. The two are quite similar, down to the names of the authors associated with revisions of the datasheet. It’s a bit overkill for this application, with a 14-bit ADC and, microphone input.

In any case, they’ve switched to a different SoC now. The BK3431 has a more limited I/O, making it more similar to the Lenze ST17H26, which is what I found in the second tag.

The second tag’s case has the shape of a rounded off square. There is a slot that a small lanyard can be looped through. Inside, it looks very much like the device pictured in this teardown on the Simply Soldered blog, which also uses the ST17H26 on a model RB-FD02 PCB. There have been some changes since then, though I’m not sure what they are. The PCB in my devices is V1.9, dated 20180606, the earlier teardown shows PCB V1.2, dated 20151212. I see some differences in component placement around the crystal and the antenna. I don’t know about accompanying differences in the schematic and if I took the time to check, and found some, I wouldn’t know the significance.

Datasheets

Ravpower USB PD Powerbank Teardown

A couple of years ago I bought a Ravpower 30W USB PD powerbank with one USB Type-C port, and two regular 5v USB ports.

It was a little quirky. Sometimes it would start charging itself from the laptop until I held the button down for 5s. At some point the behavior started getting worse, to the point that last summer I left a poor review. The seller contacted me quickly, and I had a replacement within a week. The replacement fixed the problem.

That left me with the defective unit. Today, I decided to take it apart and see what’s inside.

The highlights are:

  • A sturdy ABS case
  • 8x LG F1L 18650 cells
  • One PCB
    • Sonix SN8F57 8-bit 8051-based microcontroller
    • Cyprus CYPD2122 USB PD port controller
    • Southchip SC8802 buck-boost charge & discharge controller
      • Regulation of voltage and current for lithium ion battery charging for 1s-6s battery packs (4.2-25.2v)
      • Charging current to 10A!
      • Input voltage from 2.7-30v
      • Output to load from 2-30v & 60W

The pack sells for ~$75. To put things in perspective, you can buy eight FL1 cells for $4.41/each, which works out to about $35. That price drops to $3.56 each through a grey-market seller if you buy a thousand at a time. Ravpower is almost certainly paying less than that.

You can see more in the YouTube video I shot of the process:

Datasheets:

What IC does the MH KC24 USB QC2/3 Buck Module Use?

I want to know what IC is used on this MH-KC24 USB power module I received.

This module, like the MH-CD42 module I looked at recently, has a single IC with unhelpful markings. Since the IC on that board appears to be from Injoinic Technology, I thought the IC on this module might share the same origin.

I reviewed the product offerings on their English language site and thought the ICs for car chargers looked the most promising. Based on the summary specifications, the IP6505 fills the bill. This IP6505-based module certainly carries the same supporting components, and the IC shares the same footprint.

The IC combines an efficient synchronous buck converter and logic for negotiating power delivery using a variety of USB charging protocols. My primary interest is in Apple 2.4A/12W charging, but it also supports Qualcomm’s QC2 & QC3 protocols, which is popular among android smartphones using Qualcomm’s SoCs.

I see that their IP6518 IC, which supports 45W USB PD charging is available on inexpensive modules, too.

What IC does the MH-CD42 battery/5v power board use?

I just received a USB / LiIon power module I paid ~$2, including shipping, for on AliExpress. The model is given as MH-CD32 (link goes to what I think is the original manufacturer, though I purchased it from another seller with cheaper shipping).

The board is supposed to be an all-in-one solution for powering a 5v (ie USB powered) device from a lithium ion battery pack. I suspect the IC was originally designed for use in a USB powerbank. The basic features are:

  • Charging of 3.7v nominal, 4.2v max, lithium ion batteries.
    • 5v charging input, 2.1A max charing current
    • Battery protection for over current, over voltage and over temperature (for the charging IC, at least, there is no provision for a thermistor to sense pack temperature)
  • 5v output, up to 2.1A
  • 4-level battery “fuel gauge”
  • Power path management: when the module is externally powered, it can power the load and charge the battery with any excess power from the supply.
  • Control input that can switch the output on, or off, suitable for control by a microcontroller.
  • 100uA quiescent current.

It accomplishes this all with a single 8-pin IC, a dozen discrete passives (an inductor, eight ceramic capacitors, three resistors), four LEDs and a microswitch. All in all, it looks like a useful module.

I’m curious about what IC it uses. The package has markings, but they aren’t useful; it’s marked MH CD42, which is the model number of the module. Nothing strange about that, except that Google searches don’t turn up anything, no Chinese datasheets, just more product listings for the module.

Ordinarily, the first couple of letters of a chip marking echo the name of the manufacturer, but in this case, they instead they echo the name of the module manufacturer “MH-ET.” It isn’t uncommon that manufacturers “sand” the IC package to obscure it’s origin. In this case though, it seems that MH-ET has either remarked the chips or, more likely, had the packages custom marked.

If I were a competitor, and this were a product that had some combination of a large market, a high margin and a high selling price, I could go to great lengths to discover the true origin of the integrated circuit. I’d start by gathering the basic details of the product and using that to infer the specs of the IC. There isn’t much guess work in this case, because the product is a manifestation of the the capabilities of the IC, and its typical for the sellers to use the ICs specs when describing the module, even when the implementation cuts corners that may compromise the specs.

I’d use the specs I gathered to search catalogs and databases for similar ICs and compile a list of candidates. If my goal is to produce a competitive product in terms of cost and capabilites, I’d investigate pricing of the candidates and if any of them met the functional and cost requirements, that might be the end of it.

If I couldn’t find an equivalent chip, or if I wanted to improve my negotiating postion, or if I was involved in making or selling a competing IC, I’d dig deeper. I’d look more closely at the details of the IC, the specific package, the functions of each pin, the details of the circuit connected to each pin and I’d compare them to the documentation available for candidates I’d previously identified based on basic specifications.

Beyond that, I could order samples of the candidates and test their behavior against that of that of samples of the unknown chip. Or, perhaps I’d use chemical or mechanical means to extract the silicon ship from the enclosing package and then examine it under a microscope before and after stripping away layers of metalization on the IC. This might show me markings like a date code, part number, or logo. It would certainly show me the gross and fine structure of the circult. All of them would help me find the true origin of the integrated circuit.

I’m not going to do that though, in fact, I’ve already spent more time writing about it than I’d like to spend on what I am going to do.

Rather than going to those lengths, I’m going to take a shortcut that I happen to have available to me: I remember seeing a similar module on eBay a few months ago and I remember that the IC on that module had a distinct an unfamiliar manufactuer logo on it.

It took a little longer than I expected, but I found the ebay listing, or one like it. There IC lacks a distinctinve logo, but it does have a clear part number “IP5306,” and that part number leads to a catalog listing on a distributor’s site, a datasheet and the manufactuer, a company called Injoinic Technology.

The PCB layouts are very similar. The IC pinouts seem identical. I tried tracing out the circuit, but I could only get so far without removing components. The only real question are pins 6 & 7.

My 4.5 digit multimeter shows ~0Ohms resistance between them, suggesting they are on the same node of the circuit. However, if the IC on my MH CD42 board is the same or equivalent to the one on the IP5306, then those pins should actually be on two separate nodes of the circuit. Pin 7, on the left, should be connected directly to the near side of the inductor, while pin 6 should be connected to the far side of the inductor, by way of the low-value 500mOhm resistor you can see in the photograph.

IP5306 Typical Application Circuit

It wouldn’t be hard to pull off some components and replace them later, or it shouldn’t be, but I always seem to hit a snag on the easy jobs, like loosing a tiny component, or delaminating part of a trace. Fortunately, I have a nice Keithley 2000 6.5 Digit DMM. It’s serious overkill for most stuff, and measuring miliohms isn’t its forte, but it only took 30s to boot up (it actually has a Motorola 68030 process, like an old Mac ][, or SE/30 computer), and less time than that to show that the path from Pin 6 to Vbatt had 500mOhm higher resistance than the path from Pin 7.

So, my conclusion is that the MH CD42 IC is actually an Injoinic Technology IP5306. It’s possible that it is a “clone,” or that they both actually come from a third party, or are otherwise derived from the masks and foundry. It may also be true that there is another IC on the market that defined the specs and pinout and that a very narrow market niche has emerged around it. I already know more than I need to know, and if you’ve read this far, then you know it, too.

Bluetooth LE Notes on iBeacons and Bluetooth Tags/Trackers

I’ve been researching indoor location technoglogy which has lead me to looking more closely at the cost and effort of implementing Bluetooth Beacons, like Apple’s iBeacon or Google’s now unsupported Eddystone protocol. That led me to Bluetooth “Trackers,” “Tags” or “Key Finders.” There are also BLE sensor tags and fitness trackers. These are my barely edited notes.

Cheap Modules

There are a huge number of cheap Bluetooth ≥4 modules on eBay and AliExpress. Some are bare modules that include a Bluetooth SoC, an antenna, and supporting circuitry intended for integration into a larger device. Others are, more or less, finished devices. The have cases, and battery holders or connectors for an external USB power supply. They also often have demo firmware and apps.

Tracker devices are available for less than $2, with shipping, but they have unknown or poorly documented SoCs and repurposing them may be difficult or impossible.

For more flexible modules with well documented and supported SoCs from Nordic and TI, prices start at $4 for a basic coin cell powered device with Bluetooth 4LE support and go upward for more recent chips with support for later Bluetooth version and/or cases for more durable installation. Bare modules for incorporation into devices are available for less than $2.

  • Shenzen Wellicorp: fixed and portable beacons with waterproof housings using nRF51, nRF52 and TI CC2541 SoCs.
  • Bejing Aprilbrother: DA14580, nRF52 & TI based fixed and portable beacons and sensors.
  • Radioland Technologies TI nRF and Dialog based beacons. Available from 3rd party sellers on AliExpress, like Shenzhen Duoweisi Tech
  • Holyiot Sensors and beacons based on nRF51 & nrRF51. Also
  • Minew sensors, beacons and electronic shelf lables based on nRF51 & nRF52 and, TI BLE SoCs. Their beacons were used for Google’s first public Eddystone demo. They sell BLE 5 capable beacons for $10 + shipping, with a three unit minimum order.

Bluetooth Profiles of Interest

  • Proximity
  • Find Me

Common Bluetooth SoCs

Their are a variety of manufacturers of Bluetooth SoC, but Texas Instruments and Nordic Semiconductor seem the most common.

MfgModelIntroNotableMCU
Texas InstrumentsCC2540Oct 2010BLE v4, v5, USB 8051
CC2541Jan 2012BLE v4, v58051
CC2640Feb 2015BLE v4.2, v5Ctx-M3
CC2640R2FDec 2016BLE v4.2, v5Ctx-M3
Nordic SemiconductorNRF518222014?BLE v4.1-4.2Ctx-M0
NRF52810BLE 5Ctx-M4
NRF52811BLE 5.1
+ direction finding
Ctx-M4
NRF52832BLE 5Ctx-M4F
DialogDA14580

Texas Instruments

TI has updated SDKs for some of its BLE v4 ICs that are v5 certified for the subset of v5 features that the IC supported in v4.

TI’s BLE SoC all support a variety of peripherals relevant to sensor node applications. Some have integrated switching power supplies.

Nordic Semiconductor

Like TI, Nordics SoC’s support a variety of peripherals relevant to sensor node applications, and some have buck converters.

Nordic has a proprietary protocol called ANT which can also run on some of their SoCs at the same time as BLE.

Nordic’s nRF5 SDK includes sample applications for iBeacons, and proximity tags.

Others

  • Dialog? DA14580

Elsewhere

ToDo

Or not, but I’m at least noting them

  • Battery life estimates
  • NFC for proximity based pairing
  • Applications for UWB?
  • Sensor/fitness tags
  • “Finder” app ecosystems
  • What is WeChat Shake?
  • Is there any standardization of a protocol for configuring beacons?
  • Bt 5 Advertising Enhancements — Use of more channels for advertising packets, reducing interference. Extended advertising lets advertisements use a larger payload (in another channel), allowing more info to be conveyed in beacon applications.

CN3791 MPPT Solar Li-Ion Charger Module Hinky Circuit.

Last year, I paid about $3.66, with shipping, for this solar-powered MPPT lithium ion battery charging module on eBay to use with my small solar panels and scavenged 18650 batteries. It has some issues.

First off, the version I purchased/received is intended for 9v solar panels and I wanted to use it with a ~6v panel. This is set with a resistor divider. Careful study of photos from product listings showed that the divider was implemented using the same resistor value for the high segment of the divider, changing only the value of the lower segment’s resistor to change the setpoint.

The high segment had a value of 178KOhm and the low ranged from ~42KOhm for a 6v panel down to 12.6KOhm for an 18V panel. I didn’t have any SMD resistors of suitable value in my supplies, and I couldn’t find any I could scavenge on any surplus PCBs. I decided to use a trimpot instead. I had a variety on hand, and it would allow me to experiment on the optimal clamping voltage for the panel I had on hand, and an 18V panel I’d ordered. I chose a 200KOhm trim pot with the idea that approximating the total resistance of the existing divider would help preserve the stability of the control loop. If I were going to do it again, I’d probably choose a different configuration to minimize the impact of the pot’s temperature sensitivity. A simple choice would be ~20KOhm trimpot, configured as a variable resistor (short the wiper to one terminal) used it to replace the low segment, leaving the 178KOhm resistor in place.

After adding the potentiometer, I connected the battery and panel and adjusted the potentiometer until I maximized the charging current. I was a little surprised by how low the panel voltage was, and so I started poking around. The first thing I checked was the voltage drop across a P-Channel MOSFET on the panel input. I was surprised to find that it was 500mV, though knowing that, I wasn’t surprised the IC was noticeably warm. The panel was dissipating 1/10th of the panel voltage over the MOSFET!

Some of the photos on some of the product listings showed a simpler circuit, without anything in the panel input current path. My guess is that the MOSFET and accompanying resistor and diode were added in a revision in order to protect the circuit in case the panel polarity was accidentally reversed, and/or to block leakage of charge from battery through panel at night. A schottky diode would accomplish the same thing more simply, but with a voltage drop of ~300mV. Properly implemented, a MOSFET based “ideal diode” would have an effective resistance of ≥ 50mOhm, and a voltage drop of ≥ 50mV at the ~1A max current my panel could deliver.

I’m not completely sure how the circuit was intended to work, but clearly, it wasn’t doing the job. I wondered if it would work properly if I was using the module with a 9V manual, as intended, but that didn’t seem possible, either. The panel + was connected to the MOSFET’s source, the rest of the circuit to the drain, and the gate was connected to the drain via a resistor and diode. By my reasoning:

  • that the gate would ≅the potential of the drain
  • the voltage drop from source to drain should be as close to 0V as possible in order to maintain the efficiency of the curcuit
  • therefore, Vgs would/should approximate 0V
  • but it won’t because the Vgs threshold for the MOSFET was ~2V!

I wasn’t sure how to fix the circuit, but I was sure that the gate needed to be pulled down to a lower voltage, so I cut the trace connecting the resistor the drain and connected it to ground instead. It worked well enough that the voltage drop over the input MOSFET went from 0.5V to a trivial number. I’m pretty sure though that I didn’t fix the protection function.

I’ve since received another version of the module which has revised the input circuit. The diode and parallel resistor connecting the gate and drain are still used, but there as another resistor which connects to the charging indication pin on the CN3791, and in so doing. This pin is open drain. When the battery is charging, it is pulled low, lighting the charge indicator LED AND pulling the input MOSFET gate low. Vgs ≅ -Vpanel ≅ Vs ≅-6V, turning the MOSFET fully on.

Thinking through this further… if the battery is charged and the panel is illuminated the gate will approximate the potential of the input MOSFET drain and, since the only load on the panel is the quiescent current of the module, then Vsd ≅ 0V ≅ Vgs and so the MOSFET will be off, save any current through the body diode.

If the panel is dark and the battery is charged then Vd of the input MOSFET will, at most, be at battery voltage (Vbatt), Vs will be ~0v, Vg will ≅ Vd, Vgs ≅ Vd and the input MOSFET will be off.

If the panel is reversed Vs will be below GND and well below Vg ≅ Vd ≅ Vbatt so Vgs will be Vbatt + Vpanel, and the MOSFET will be off. Note: This means that reverse polarity with an ~18V nominal panel would exceed the Vgs maximum of 20V for the TPC8107 MOSFET used at the input.

If I get around to it I’ll draw a schematic and add it to this post.