Roland Turner

about | contact

A first look inside the generally-available TraceTogether tokens

On September 14 the population-wide rollout of the token began. I collected mine two days later for use while running because they're much easier to carry and to waterproof than a phone is. Today I finally got around to opening it up.

Per GovTech's announcement in August, the company who made the initial batch of tokens that we examined at the teardown session (PCI) was also one of the successful bidders for the larger project. My token is all but identical to those that we examined, so I assume that it's one of those made by PCI. The one material change that I've identified so far is a bit of a mystery though: an IC has been removed!

Clock side

On the left is the token that I examined during the teardown session in June; on the right is the one that I collected for personal use a few weeks ago. The boards would appear to be identical, right down to their being "REV A". The sticker to the right of REV A does differ between boards and appears to contain 196 bits of information, which suggests a unique identifier, so I've blanked it for my personal one.

The built-in coin cell is BAT2 and is presumably used to power a real-time clock. This is separate from the much larger, removable coin cell that's used to power the entire token. More below.

U9 (to the right of the battery) is something of a mystery at present. It's a 4-pin device which appears to be labelled A6 with 6 underlined and A "overlined" (is there a better word for this?). Some study of the copper traces and vias on the boards is going to be required to infer its place in the system. The proximity to a test point (TP4) is interesting.

Q1 (labelled KFQ 845, near the bottom) would appear to be a voltage regulator, although I've not been able to identify it. Z1 immediately beside it is presumably a Zener diode to protect the system against excessive voltage from installing the wrong battery or similar, both because of its being in parallel with the main coin cell and the regulator, and the unusual name (Z is not a standard class designator).

Clock area

The way this is laid out happens to make tampering with the clock chip difficult in that you'd need to remove the coin cell first, at which point the clock would stop. (Yes, you could power it separately, etc., but it would be more difficult.) Perhaps it's just about putting all of the clock-related stuff in one part of the board.

There's not much here:

Antenna side

The masking of the part numbers at the June session is the rather obvious green paint covering the antenna and the larger chips.

It's worth noting that the BlueNRG-1 and BlueNRG-2 are pin-compatible (the latter can be slightly more efficient during sleep), meaning that we can't say for certain which IC was present at the teardown session, but given the layout of the surrounding power supply components (L3, C27, C28), oscillator components (OSC2, C33, C34, L2) (OSC1, C1, C43), and antenna match (U6, R33, C65 (missing), L40, C66, R36) — all of which appear to be according to the reference design from the ST documentation — we can reasonably rule out any materially different IC. This has an important consequence: I had assumed a separate SoC and radio ICs, but the BlueNRG ICs combine both of these functions onto a single IC, which begs the question: why were there three large ICs at the teardown session? At present, I have no idea:

That's all I have for today. More soon!