Nest Protect Teardown

Contributors: Nick Poole

Sensor Scavenger Hunt

Now we return to the main board to hunt down all of the sensors that one might expect in a device like this. Somehow, the Nest Protect needs to know the following:

• Is there smoke in the room? (obviously)
• Is there CO in the room? (obviously)
• Is there someone standing below me? ("Pathlight" feature)
• Is there someone waving at me? ("Heads Up" feature)
• Is the light on? ("Nightly Promise" feature)

The Amazon listing for this product actually has a summary of the sensor package, which claims that the Protect boasts the following sensors:

• Photoelectric smoke sensor
• Carbon monoxide sensor
• Heat sensor
• Three activity sensors (A little vague, but okay)
• Ambient sensor (You know, to sense the ambiance)

So all-in-all, we should find enough embedded devices to account for the functionality above. That and at least one controller to wrangle all that data. Oh yeah, and at least one radio to get to The Internets.

Proper shielding is important to the good folks at Nest... apparently. This board has so many little shields on it that they might as well have just wrapped it in foil. Using a small, flat-head screw driver, I popped all of the shielding off like unwrapping a tiny, FCC compliant Christmas presents. And much like Christmas morning, it was a positive overall experience peppered with moments of confusion and delight. Behold:

Controllers and Radio ICs

Let's start with the biggest package on the board and work our way around counter-clockwise:

If I had to guess, based purely on the number of pins, this is the brains of the operation. Google tells me that what we're looking at here is a Freescale Kinetis K60, a 32-bit ARM Cortex based MCU that boasts a bunch of peripherals including USB and Ethernet. The part number indicates a flash size of 512K but they seem to have augmented that with a chunk of discrete memory on the side.

The two miniature rf connectors in this corner of the board hint at the presence of two separate radios, a dynamic duo of which the EM357 is half. The EM357 is a ZigBee radio SoC featuring a 32-bit ARM Cortex processor, 2.4GHz transceiver, and a bunch of GPIO. Hold on, though, I thought this thing was supposed to connect to my WiFi so what is this ZigBee radio for? If you remember our Nest thermostat teardown, you may remember Nate discovering a ZigBee radio in that product as well, so we expected to see this. ZigBee not only allows the Nest products to talk to eachother, but it leaves the door open for them to communicate with future home automation products. Aside from being a popular public-band standard, ZigBee also has no trouble co-existing with WiFi. That reminds me...

Ah yes, the WiFi radio! What we're looking at here is the muRata Type ZX WiFi Module, a b/g/n WiFi module with built-in Broadcom chipset, crystal, RF filter, and passives. Not bad considering its only 7mm on its longest side. Doesn't look like a datasheet is available unless you're a MuRata Direct customer, so that's about all we know on this one.

For those of you counting, this is the third ARM Cortex core we've crossed paths with during this teardown. This time it's buried in another Freescale MCU, specifically the Freescale K16. I wouldn't venture to guess what this MCU's job is. It is located close to the piezo alarm and critical sensors, so perhaps it handles the critical safety functions separate from the "convenience" functions.

Sensors

But wait, aren't there supposed to be a bunch of sensors on this thing? Where are they all hiding? Time to flip this thing over and check out the other side. Starting from the CO detector tube and moving clockwise this time:

Here's a boring looking component that could warn you of an invisible threat... no, not ninjas, carbon monoxide poisoning! Removing the shielding reveals that this component is a Figaro TGS-5342 CO Sensor, an electrochemical detector from the Japanese company Figaro Engineering Inc. I won't confirm by cutting it open, but this thing might be full of sulfuric acid! Cool, huh? It turns out that electrochemical CO detectors are actually fuel cells that use CO as the fuel. The CO is oxidized to CO2 at one end, oxygen is consumed at the other, and a current is produced. The amount of current produced is proportional to the concentration of CO in the cell making it not only capable of signaling the presence of monoxide but also of quantifying it.

This is your standard, run-of-the-mill piezoelectric siren. These things are loud, like, ear-damaging loud. They're also a commodity part, and there's nothing really special about this one. I had to search the patent number on the device just to find some basic specs on it, but you can buy these anywhere.

Like trying to identify a robber from the blurry bank security footage, trying to track down the manufacturer of this light sensor was a long and arduous process with no luck. I can't give you any specs on this part except to say that it's tiny, appears to have 6 pins, and may or may not be a color light detector.

Ah yes, the telltale shape of an ultrasonic transducer. I suppose these guys are used to determine whether or not you're waving at the unit because the PIR sensor probably doesn't work particularly well for that. It is odd that it has both, though. I wasn't able to identify who makes these, so I'm not certain what the beam width is supposed to be. Safe to say, it has something to do with either the "Pathlight" or "Heads Up" features. It's a handy device to have on board if they ever want to upgrade the firmware and add interactivity.

Well if it isn't our old friend the SHT20. We carry a breakout board for another device in this same family. We love these, and they're everywhere. Small, cheap, and reliable. I'm not sure whether the temp and humidity data help determine the presence of a threat, calibrate other sensors, or if it's simply good data to have when you're making a peripheral device for a thermostat. Having temp and humidity in several rooms throughout your house accessible by the same computer that controls your HVAC? That could allow for some cool features.

This is the photoelectric smoke detector that I was talking about earlier. Because it's a custom part there's no datasheet available, and it would be very hard to identify the emitter/detector pair that they've used. I only mention it here as part of the sensor package, but I'm afraid it is among the few components on this board that lead very private lives.

Like staring into the eye of a cold and uncaring machine, except this cold and uncaring machine could save your family from a house fire. The PIR sesnsor doesn't have any identifying markings but wins the award for most cleverly mounted device. Well done, PIR, well done indeed.