Since I got access to a couple of Estimote UWB beacons, I was craving to find out what makes it tick. Let me take you on the journey of absolutely destroying one of them indefinite. February 2018 was the month I finally cracked all the details of all major components on the PCB 🙂 I will give an overview of all components I have identified and where these components connect to both controllers. Not all components might be an exact match, but I will figure that out later. Let me first tell you how I got to the pictures of the PCB.

I still might need some help to find out the components of the “High efficient Step-Down DC-DC converter”. I did not identify them yet. If anyone can tell me which components they are, please leave me a comment.

This slideshow requires JavaScript.

Normally before doing a reverse engineering effort I look at the FCC pages for more information on the device. It seems that the UWB device does not have any FCC certification (could not find it on their site nor on the packaging of the device). So I went ahead with desoldering every component and labeling them from 1 to 130. This number is corresponding with the container where I put the component in. The last component to be desoldered with hot air was the DW1000 which I did not have a container for so I tossed it together with the nRF chip. This explains the number 98-2. In time I will remove all the numbers because I have given them a significant name (i.e. U1, X1, R1, C1). I will spread the BOM in tables throughout the whole article not to make it a bulky thingy.

When the process continued I was able to detect which passive components were belonging to which IC’s so I gave them a color coding on the above image. After looking up the datasheet of each active component I could see a 1:1 correlation between all the reference schematics and the Estimote UWB. I will make a paragraph on every section and try to come up with a schematic for that:

nRF52832 Bluetooth® SoC ARM® Cortex®-M4 32-bit processor (Indigo)


Name Type Component description
U1
(98)
nRF52832 Advanced performance Bluetooth5/ANT/2.4GHz proprietary SoC
C???
(58)
100nF Bypass capacitor VDD
C???
(99)
100nF Bypass capacitor VDD
C???
(67)
100nF Bypass capacitor VDD
C???
(59)
100nF Bypass capacitor VDD
X???
(57)
32.768kHz XTAL SMD 3215, 32.768 kHz, 9 pF, ±20 ppm
C???
(55)
12pF Crystal load capacitor
C???
(56)
12pF Crystal load capacitor
C???
(68)
0.8pF RF correction network?
L???
(69)
3.9nH RF correction network?
C???
(70)
100pF
X???
(71)
32MHz XTAL SMD 2016, 32 MHz, Cl=8 pF, Total Tol: ±40 ppm
C???
(74)
12pF Crystal load capacitor
C???
(72)
12pF Crystal load capacitor
L???
(62)
15nH ???
L???
(60)
10uH ???
C???
(61)
1.0uF ???

SKY66112-11: 2.4 GHz ZigBee®/Thread/Bluetooth® Smart Front-End Module (Gold)


Name Type Component description
U2
(81)
SKY66112
-11
2.4 GHz ZigBee®/Thread/Bluetooth® Smart Front-End Module
TP???
(137)
CRX
TP???
(136)
ANT_SEL
TP???
(139)
CPS
TP???
(138)
CTX
TP???
(135)
CHL
C???
(88)
1nF Bypass capacitor VDD (closest to DUT)
C???
(89)
100nF Bypass capacitor VDD
C???
(87)
1nF Bypass capacitor VCC2 (closest to DUT)
C???
(86)
100nF Bypass capacitor VCC2
C???
(85)
4.7uF Bypass capacitor VCC2
C???
(80)
1nF Bypass capacitor VCC1 (closest to DUT)
C???
(79)
100nF Bypass capacitor VCC1
C???
(78)
4.7uF Bypass capacitor VCC1
L???
(93)
??? Antenna matching network ANT1
C???
(92)
??? Antenna matching network ANT1
J?
(133)
uFL Antenna
connector
Connector for the external BLE antenna
L???
(91)
??? Antenna matching network ANT1
C???
(90)
??? Antenna matching network ANT1
AE1
(132)
PCB antenna 2.4 GHz meandering PCB antenna
C???
(94)
??? Antenna matching network ANT2
L???
(95)
??? Antenna matching network ANT2
C???
(96)
??? Antenna matching network ANT2
J1
(97)
uFL Antenna
connector
Connector for the external BLE antenna
U2 pin 21 (RFIN) connected via C???(68) and L???(69) to U1 pin 30 (ANT)
U2 pin 8 (ANT1) connected via L???(93) and ???(92) to J2 and then via L???(91) and C???(90) to AE1
U2 pin 6 (ANT2) connected via C???(94) and L???(95) and C???(96) to J1
U2 pin 4 (ANT_SEL) connected via TP???(???) to U1 pin 28 (P0.23) (In the traces I have included a via to ground, should be removed, bcos it is not there at all!)
U2 pin 3 (CSD) connected to VCC
U2 pin 2 (CRX) connected via TP???(???) to U1 pin 29 (P0.24) (In the traces I have included a via to ground, should be removed, bcos it is not there at all!)
U2 pin 15 (CPS) connected to U1 pin 39 (P0.27) + TP???
U2 pin 17 (CTX) connected to U1 pin 38 (P0.26) + TP???
U2 pin 19 (CHL) connected to U1 pin 37 (P0.25) + TP???

DECAWAVE DW1000 single chip Ultra Wideband (UWB) low-power IEEE802.15.4-2011 transceiver IC (Turquoise)


Name Type Component description
U3
(98-2)
DW1000 DECAWAVE single chip Ultra Wideband (UWB) low-power IEEE802.15.4-2011 transceiver IC
C???
(114)
47uF Decoupling capacitor VDDPA
C???
(126)
0.1uF Decoupling capacitor VDDPA1
C???
(128)
330pF Decoupling capacitor VDDPA1
C???
(130)
10pF Decoupling capacitor VDDPA1
C???
(125)
0.1uF Decoupling capacitor VDDPA2
C???
(127)
330pF Decoupling capacitor VDDPA2
C???
(129)
10pF Decoupling capacitor VDDPA2
C???
(11)
10nF Decoupling capacitor VDDLNA
C???
(32)
0.1uF Decoupling capacitor VDDBAT
C???
(111)
0.1uF Decoupling capacitor VDDIOA
C???
(113)
0.1uF Decoupling capacitor VDDAON
C???
(112)
0.1uF Decoupling capacitor VDDLDOD
C???
(107)
4.7uF Decoupling capacitor VDDLDOA
C???
(31)
0.1uF Decoupling capacitor VDDLDOA
X???
(29)
38.4 MHz +/-10pp ABM10-165-38.400MHzT3
KX-5T (need to request tight tolerance option)
HDD10RSX-10 509344
C???
(30)
10pF Crystal load capacitor
C???
(22)
10pF Crystal load capacitor
R???
(21)
11K 1%
C???
(20)
0.1uF
C???
(19)
0.1uF
C???
(16)
1.2pF
R???
(18)
16K
C???
(17)
22pF
C???
(15)
0.1uF
C???
(14)
0.1uF
C???
(13)
0.1uF
C???
(12)
18pF
C???
(09)
820pF
R???
(10)
270R
C???
(07)
12pF Antenna matching network
C???
(06)
12pF Antenna matching network
T???
(05)
HHM1595A1 SMT UWB Balun 3-8 GHz
AE2
(01)
AH086M
555003-T
Chip Antenna, UWB/WiMAX, 5.55 GHz
C???
(124)
0.1uF
C???
(109)
4.7uF???
U???
(108)
LXDC2HL18A-052
C???
(110)
0.1uF
C???
(34)
0.1uF
C???
(33)
0.1uF
R???
(36)
100K

Pressure Sensor (Light Turquoise)


MEMS digital output motion sensor: ultra-low-power high-performance 3-axis “femto” accelerometer (Lime)


1-Mbit serial I²C bus EEPROM (Lavender)


Battery supply (Brown)


GPIO (Yellow)


Level shifter/tristate coupling between nRF and DW1000 (Dark Red)


1.8 Volt power supply for DW1000 (Orange)


RGB LED (Red)


Light intensity sensor? (Rose)

Now getting back to destroying the PCB. After cleaning up the PCB I used a sanding paper to get rid of the copper and epoxy bit by bit. The first part I did mechanically, but the last touches were done manually to prevent sanding away too much copper.


Mind that this article is still in progress. The major chapters are defined and in the coming weeks I will add the content of all chapters.


A small section in between, why do I do this? From my Altran innovation budget at work I was able to buy 12 Estimote UWB location beacons. A couple of question:

  • You might think, why buy 12 of them? 1) because I can, 2) I want to do research on indoor navigation, 3) because I can, 4) The alternative prozyx.io did not fit in my innovation budget and an email to one of the founders did not deliver a reply.
  • Why UWB technology? 1) because I can, 2) It works, at lease that is what sales told me (LOL), 3) you do not need a visible Line of Sight (LOS) from the Device to the Anchors, it should work with the device in your inner pocket.
  • What are the alternatives (with great accuracy)? 1) Philips Visible Light Communication, 2) could not find any other really working alternatives.
  • What does not work (in my opinion)? 1) BLE beacons, 2) Ultrasone
  • What else? Wikipedia has a page on Indoor positioning. Al the alternatives there were not to my use or I did not find them to be fun to investigate. Maybe that will change when I cracked the UWB technology.

Why not choose Philips Visible Light Communication? As an employee of Altran I do have easy access to co-workers who have worked with that thechnology. But I don’t want to do that. All my work on this site is in the open-source domain. I also don’t see any open-source libraries which make use of that technology (yet). Maybe I need to look harder. In time I do want to make a comparison between UWB TimeOfFlight and VisibleLightCommunication. Subscribe to this site and you will get a message as soon as I did that.


The interconnects between the and nRF52832 the DW1000 is done through a Voltage-level Translator (TXB0104 4-Bit Bidirectional Voltage-level Translator With Automatic Direction Sensing). Two extra signals are steered by separate 1-Bit Bidirectional Level-Shifting, Voltage-Level Translators (TXS0101 1-Bit Bidirectional Level-Shifting, Voltage-Level Translator With Auto-DirectionSensing for Open-Drain and Push-Pull Applications).

If you look closely you will see that all three levelshifters get their power supplies from 2 different gray powerplanes.

Name Type Component description
R???
(39)
??? Voltage divider for analog reference?
R???
(40)
??? Voltage divider for analog reference?
U1 pin 6 (P0.04/AIN2) connected via ResistorDivider R???(39)(connected to VCC) and R???(40)(connected to GND)
Name Type Component description
(63) M41T62 Low-power serial real-time clocks (RTCs) with alarm
C???
(54)
100nF ??? Bypass capacitor VDD
Name Type Component description
U4
(101)
TXB0104 4-Bit Bidirectional Voltage-level Translator With Automatic Direction Sensing
C???
(102)
Bypass capacitor VCCA
C???
(103)
Bypass capacitor VCCB
U5
(37)
TXS0101 1-Bit Bidirectional Level-Shifting, Voltage-Level Translator With Auto-DirectionSensing for Open-Drain and Push-Pull Application
C???
(38)
Bypass capacitor VCCA
C???
(35)
Bypass capacitor VCCB
U6
(105)
TXS0101 1-Bit Bidirectional Level-Shifting, Voltage-Level Translator With Auto-DirectionSensing for Open-Drain and Push-Pull Application
C???
(104)
Bypass capacitor VCCA
C???
(106)
Bypass capacitor VCCB

Here a list with the signals which are tied between the two controllers:

nRF52832
pin number
nRF52832
pin description
Test point DW1000
pin number
DW1000
pin description
Handled by U4, Chip select is fired by U1, Pin 7, P0.05/AIN3
18 P0.15/TRACEDATA[2] TP1, TP2 24 SPICSn
17 P0.14/TRACEDATA[3] TP3, TP4 39 SPIMOSI
16 P0.13 TP5, TP6 40 SPIMISO
15 P0.12 TP7, TP8 41 SPICLK
Handled by U5, Chip select is fired by U1, Pin 7, P0.05/AIN3
14 P0.11 TP9 45 IRQ / GPIO8
Handled by U6, Chip select is fired by U1, Pin 19, P0.16/TRACEDATA[1], TP10
n/a Ground TP11 27 RSTn

I guess that the DW1000 is consuming loads of energy and I also think that the complete power rail of that section of the board is switched on/off depending on the need for that function. I am not sure if the level of both power rails (nRf and DW1000) have different voltage levels. I will be doing some measurements with a scope and logic analyzer later.

Components

On the site of Estimote there were the specs of the UWB device. It gives hints on which components I am looking for in the journey to crack this pearl.
==========
Estimote Location Beacon with UWB
Hardware revision: I1.2

MCU
Bluetooth® SoC
ARM® Cortex®-M4 32-bit processor with FPU
64 MHz Core speed
512 kB Flash memory
64 kB RAM memory

Radio: 2.4 GHz transceiver
Bluetooth® 4.2 LE standard
Range: up to 200 meters (650 feet)
Output Power: -20 to +4 dBm in 4 dB steps, “Whisper mode” -40 dBm, “Long range mode” +10 dBm
Sensitivity: -96 dBm
Frequency range: 2400 MHz to 2483.5 MHz
No. of channels: 40
Adjacent channel separation: 2 MHz
Modulation: GFSK (FHSS)
Antenna: PCB Meander, Monopole
Antenna Gain: 0 dBi
Over-the-air data rate: 1 Mbps (2 Mbps supported)

Radio: Ultra Wideband (UWB)
IEEE802.15.4-2011 UWB compliant
Precision real time location systems (RTLS) using two-way ranging
Ranging accuracy (using two-ranging scheme)up to 25cm
Usable ranging distance indoors- up to 30m (in real world conditions between 2 UWB beacons)
Support for 6 RF bands from 3.5 GHz to 6.5 GHz

Sensors
Motion sensor: ultra-low-power, high-performance, 3-axis “femto” accelerometer
Temperature sensor
Ambient Light sensor
Pressure sensor

Additional features
EEPROM Memory 1 Mb
RTC clock
NFC
GPIO

Power Supply
3 x CR123A – 3.0V lithium primary cell battery (replaceable)
High efficient Step-Down DC-DC converter

==========

MCU
nRF52832 Bluetooth® SoC ARM® Cortex®-M4 32-bit processor

UWB
And this is the part where I am interested in. With this technology you can measure the Time of Flight (TOF) which says something about distance. Using triangulation will tell you also the absolute position especially indoors.

Bluetooth Low Energy (BLE)
The specs say it supports Bluetooth® 4.2 LE standard. But the spec of the nRF chip says it supports Bluetooth® 5. Ofcourse something to look in to. There is a smart front end which has 2 antenna’s. One PCB antenna and one connector for an external antenna. The end goal is to connect all the BLE devices together in a mesh network. A room should be fitted with a couple of UWB Anchors which are stationary beacons. The other beacons in the room should determine the position and share that position with the mesh network. One of the anchors is connected to a gateway which shares all locations of all tags with a WiFi network. Then you can connect any phone to the WiFi network and keep track of the UWB tags in the building.

Sensors

The list of sensors was guiding me in which components (or equivalent components) could be on the PCB. Just combine the exact text with the SMD markings and you find the component on Google, Bing or whatever other search engine. I wish it was that easy, but in the end I think I found out enough to work with.

Name Type Component description
(77) LIS2DH12 MEMS digital output motion sensor: ultra-low-power high-performance 3-axis “femto” accelerometer
(??) (TBD) Temperature sensor (not located yet)
(03) (TBD) Ambient light sensor
(84) (TBD) Looks like a pressure sensor, did not find a datsheet which matches the pin layout

TODO components list:
(02) Decoupling capacitor for ambient light sensor???
(04) RGB LED
(23-28)
(41-53)
(64-65)
(73)
(75-76)
(82-83)
(115-123)
(98-2)

Motion sensor
The specs refer to a “ultra-low-power, high-performance, 3-axis “femto” accelerometer”. Googling it shows up with a picture which looks quite similar to component 77.

Temperature sensor
Could not find this one (yet).

( light sensor
Located the component, but did not find the type yet.

Pressure sensor
Located the component, but did not find the type yet.

Additional features

Name Type Component description
(66) M24M01 1-Mbit serial I²C bus EEPROM, WLCSP-8 package
AE3
(131)
PCB traces HF antenna for NFC, 13.56 MHz
J3
(08)
Connector For GPIO signals

Memory

RTC clock

NFC

GPIO
On the board is a connector which can be used for GPIO. On this connector you can run the robotics indoor example as described on the Estimote website. It looks to be open source at first glance, but it seems to have compiled libraries. Ofcourse I will have a look on how to hack into that later.
The connector is reachable even without taking the PCB out of its casing. On the silicone casing there is a marking where the 4 pins should be inserted. There is also another place where you can do GPIO and that he at the pads where the pogo pins can be hooked up to. These can be used to do firmware upgrades and it can probably be used to power the unit.


A lot more can be done to find out its inner workings. Stay tuned and subscribe to this site to receive a notification when the article is changed.

Leave a Reply