$2 Bluetooth Tracker / Finder / Tag Teardown

Some research into the present and near-future state of indoor locating technology led me, inevitably, to Bluetooth Low Energy (BLE) beacons. Bluetooth Low Energy led me, inevitably, into a short digression into Bluetooth “tags” for finding lost items like keys.

I just received a couple such tags I ordered from AliExpress for less than two dollars, each, and I made a video showing what’s inside when you open them up.

Yeah, I misspelled “bauble” in the title sequence.

These Bluetooth tags for finding lost items appeared on the market at about the time that Bluetooth Low Energy (Bt 4) started appearing in the latest smartphones. I don’t know who was first on the market, though I’ve seen the suggestion that the idea may have originally come from Nordic Semiconductor, one of the biggest companies dedicated to making chips for low-powered RF applications. I do know that Tile is probably the dominant vendor at this point.

The basic Bluetooth key finder “tag” is a small device, the size a condom packet, or a matchbook that can be carried on a keychain. Inside there is a small circuit board with a Bluetooth SoC (system on chip), a microswitch, battery, a pezioelectric speaker, and a few supporting components.

When it is powered on, the tag transmits to “advertise” itself. When it is advertising itself, a companion app, running on a smartphone can detect it and connect to it.

Once connected, the app periodically checks the signal strength of the tag. If the signal drops below a preset threshold, or is lost entirely, the app will notify the user, allowing them to stop what they are doing and find the object before they become too far separated from each other. The tag may start “chirping” automatically to make it easier to find. If the user needs help finding the tag while still nearby they can also use the app to instruct the tag to start chirping.

The system also works in the opposite direction. If the user is carrying the tag on a keychain in their pocket or purse, then the automatic chirping will warn them that they’ve become separated from their phone. If they realize they can’t find their phone when they are still nearby, they can also push the button on the tag to trigger a sound on the phone in order to make the phone easier to locate.

This basic functionality seems enough to be useful to people who loose track of things a lot. At this point, its available for less than $2, if one knows where to shop. For that price, one gets a functional but crummy app. The app may have added functionality, like the ability to use GPS to map the location where the phone was last able to communicate with the tag. This could be useful to determine you left your keys at the gym, rather than the office.

Tile, and others have gone further, in order to justify charging $20, rather than $2, and also to enhance their competitive position. If you use one of Tile’s tags, then, if your tag and your phone become separated, Tile’s app, working with their backend system, can check to see if any other Tile user’s phones “see” your tag, and then let you know where.

This tag-finding network sounds clever, but I wonder how well it works, and how useful it really is, particularly given the potential privacy concerns. It’s certainly possible to implement in a way that preserves privacy. In fact, Apple recently described the outlines of one such system they are developing to help people find lost or stolen Apple devices, extending their “Find My” app from iPhones to Apple Bluetooth devices, like AirPods, and also beyond WiFi range for Macintosh computers.

Apple is also rumored to be working on their own Bluetooth tag to allow keys and other objects to be tracked by the system. This might explain why Tile has recently partnered with a number of Bluetooth silicon makers, including Nordic, to extend the Tile network to third-party devices.

Back to the $2 tags I took apart, a few things of note:

The first has a teardrop-shaped case. The printed instructions point to the cTracing app. It shows up as “ITAG” using a general purpose bluetooth scanning app. Inside, I found a model XTR-FTQ-3432 PCB with V1.2, dated in 20181105. The SoC is from a Shanghai design house called Beken, and the part is BK3431.

Back in 2015, Brian Khuu tore down a tag that used the same case. His tag came, packaged for retail, in a box labeled iTag. Inside he found a different IC, labeled as ST17H25. One of the commenters identified it as a Telink TLSR8266 F512. It is actually a Lenze ST17H25. The two are quite similar, down to the names of the authors associated with revisions of the datasheet. It’s a bit overkill for this application, with a 14-bit ADC and, microphone input.

In any case, they’ve switched to a different SoC now. The BK3431 has a more limited I/O, making it more similar to the Lenze ST17H26, which is what I found in the second tag.

The second tag’s case has the shape of a rounded off square. There is a slot that a small lanyard can be looped through. Inside, it looks very much like the device pictured in this teardown on the Simply Soldered blog, which also uses the ST17H26 on a model RB-FD02 PCB. There have been some changes since then, though I’m not sure what they are. The PCB in my devices is V1.9, dated 20180606, the earlier teardown shows PCB V1.2, dated 20151212. I see some differences in component placement around the crystal and the antenna. I don’t know about accompanying differences in the schematic and if I took the time to check, and found some, I wouldn’t know the significance.

Datasheets

Bluetooth LE Notes on iBeacons and Bluetooth Tags/Trackers

I’ve been researching indoor location technoglogy which has lead me to looking more closely at the cost and effort of implementing Bluetooth Beacons, like Apple’s iBeacon or Google’s now unsupported Eddystone protocol. That led me to Bluetooth “Trackers,” “Tags” or “Key Finders.” There are also BLE sensor tags and fitness trackers. These are my barely edited notes.

Cheap Modules

There are a huge number of cheap Bluetooth ≥4 modules on eBay and AliExpress. Some are bare modules that include a Bluetooth SoC, an antenna, and supporting circuitry intended for integration into a larger device. Others are, more or less, finished devices. The have cases, and battery holders or connectors for an external USB power supply. They also often have demo firmware and apps.

Tracker devices are available for less than $2, with shipping, but they have unknown or poorly documented SoCs and repurposing them may be difficult or impossible.

For more flexible modules with well documented and supported SoCs from Nordic and TI, prices start at $4 for a basic coin cell powered device with Bluetooth 4LE support and go upward for more recent chips with support for later Bluetooth version and/or cases for more durable installation. Bare modules for incorporation into devices are available for less than $2.

  • Shenzen Wellicorp: fixed and portable beacons with waterproof housings using nRF51, nRF52 and TI CC2541 SoCs.
  • Bejing Aprilbrother: DA14580, nRF52 & TI based fixed and portable beacons and sensors.
  • Radioland Technologies TI nRF and Dialog based beacons. Available from 3rd party sellers on AliExpress, like Shenzhen Duoweisi Tech
  • Holyiot Sensors and beacons based on nRF51 & nrRF51. Also
  • Minew sensors, beacons and electronic shelf lables based on nRF51 & nRF52 and, TI BLE SoCs. Their beacons were used for Google’s first public Eddystone demo. They sell BLE 5 capable beacons for $10 + shipping, with a three unit minimum order.

Bluetooth Profiles of Interest

  • Proximity
  • Find Me

Common Bluetooth SoCs

Their are a variety of manufacturers of Bluetooth SoC, but Texas Instruments and Nordic Semiconductor seem the most common.

MfgModelIntroNotableMCU
Texas InstrumentsCC2540Oct 2010BLE v4, v5, USB 8051
CC2541Jan 2012BLE v4, v58051
CC2640Feb 2015BLE v4.2, v5Ctx-M3
CC2640R2FDec 2016BLE v4.2, v5Ctx-M3
Nordic SemiconductorNRF518222014?BLE v4.1-4.2Ctx-M0
NRF52810BLE 5Ctx-M4
NRF52811BLE 5.1
+ direction finding
Ctx-M4
NRF52832BLE 5Ctx-M4F
DialogDA14580

Texas Instruments

TI has updated SDKs for some of its BLE v4 ICs that are v5 certified for the subset of v5 features that the IC supported in v4.

TI’s BLE SoC all support a variety of peripherals relevant to sensor node applications. Some have integrated switching power supplies.

Nordic Semiconductor

Like TI, Nordics SoC’s support a variety of peripherals relevant to sensor node applications, and some have buck converters.

Nordic has a proprietary protocol called ANT which can also run on some of their SoCs at the same time as BLE.

Nordic’s nRF5 SDK includes sample applications for iBeacons, and proximity tags.

Others

  • Dialog? DA14580

Elsewhere

ToDo

Or not, but I’m at least noting them

  • Battery life estimates
  • NFC for proximity based pairing
  • Applications for UWB?
  • Sensor/fitness tags
  • “Finder” app ecosystems
  • What is WeChat Shake?
  • Is there any standardization of a protocol for configuring beacons?
  • Bt 5 Advertising Enhancements — Use of more channels for advertising packets, reducing interference. Extended advertising lets advertisements use a larger payload (in another channel), allowing more info to be conveyed in beacon applications.