Amazon Echo Flex Teardown

At Christmas we purchased an Amazon Echo Flex which was on special offer at the time.  The Echo Flex is a plug-in smart home controller using the Amazon Alexa ecosystem. After having it sitting on the shelf for 3 months, we finally took it apart to see what’s inside.  

The Echo Flex has two microphones, a small speaker, Audio Output via a 3.5mm jack and USB type A port for charging devices and adding expansion devices. The Flex is controlled by voice commands to compatible smart home devices.

Front of the Echo Flex

The front of the Echo Flex has an indicator LED, two microphone holes, Action button, Mic On/Off button and a mini speaker and measures 67mm x 72mm

Back of the Echo Flex

The back has a UK mains power plug and model information sticker with serial number, product logos and certification marks.

Base of the Echo Flex

The base has a single USB Type A port which can supply up to 7.5W of power and two locator holes for accessories.

Side of the Echo Flex

One side of the Flex is plain plastic and the other side has a single hole for the 3.5mm stereo audio output.

Opening the Case

As this is a mains electric powered device with a built-in power supply, only take it apart at your own risk. I am not responsible if you electrocute yourself, set your house on fire or some other disaster!

To remove the plastic cover, first remove the sticker below the power input pins which will reveal a torx screw.

Removing this screw and sliding a thin piece of metal between the two halves to release the plastic clips will allow you to separate the two parts of the case revealing the two circuit boards which are connected via a small flat-flex cable.

Internal and PCBs

Power Supply

The power supply is a switching PSU with a 240V AC input and a 5V DC output.  It is a completely sealed unit with a plastic enclosure wrapped in an aluminium shield.

We tried to remove the metal shield to get to the internals but it is designed in such a way that it would be difficult to disassemble and then reassemble into the same shape without the original metal folding tools so we left the PSU alone.

USB Board

Next to the PSU is a small PCB containing the USB socket, 3.5mm audio jack socket and a flat flex connector.  The only components on the board are a TPS2547 USB charging port controller from Texas Instruments and a few discreet resistors and capacitors.

The board is secured to the case with two torx screws.

Processor Board

Download high resolution PCB image.

The processor board contains the components for audio input and output, CPU and memory, LED output, wireless communication and power regulation.  Most of the components on the Echo Flex are the same as those used on the Echo Dot and Echo Input so it looks like Amazon is reusing the same parts on most of their devices to save on design and build costs.

The outer facing side of the processor board contains the connector for the flat flex cable, two push switches, 2 LEDs, 2 small ICs and a bunch of capacitors and resistors.  The Bluetooth and Wi-Fi antennas are also etched into this side of the PCB either side of where the USB connector sits.

The bulk of the components for the Echo Flex can be found on the inner facing side of the processor board.  To make identification easier the main components have been marked on the photo below with coloured squares.

Starting from the top left corner is a microphone marked M2367 0905 M2 269.  Nothing could be found online about this device, but it looks like a surface mounted MEMs microphone.  There is a second identical microphone on the top right corner of the board and they both connect to the ADC.

Next to the microphone is a 74LCX74 dual flip flop (pink outline).  On the Echo Dot the flip flop was used for switching the state of the mute button and it looks like it has the same function on the Echo Flex.

Audio from the microphones is converted to a usable format using a Texas Instruments TLV320ADC3101 stereo ADC with digital microphone support and miniDSP (blue outline).  The TLV320ADC3101 communicates with the CPU using an I2C and I2S bus. I2C is used to configure the ADCs on start-up and the audio stream is sent along the I2S bus.  This is the same ADC as used on the Echo Dot.

On the top right of the board is a LP5018 from Texas Instruments.  The LP5018 is and 18-channel I2C constant-current RGB LED driver and is used to drive the two dual colour LEDs on the other side of the board.

At the centre left of the board is a MediaTek MT7658CSN (purple outline) dual-band Wi-Fi and Bluetooth controller. This controller is designed to be paired with the main CPU and communicates with the outside world.  Two PCB tracks route from the MT7658CSN to the PCB antennas on the other side of the board.

In the centre of the board are the memory chips.  A K4B2G1646F-BYMA (yellow outline) 2 Gb DDR3 chip provides the RAM for the CPU and a TC58NVG2S0HBAI4 (red outline) 4 GBIT (512M x 8 BIT) CMOS NAND EEPROM provides the storage for the firmware.

At the centre right of the board is the main processor.  The MediaTek MT8516BAAA (green outline) is the same CPU as used on the Echo Dot and Input.  A datasheet for the MT8516BAAA is not available online but according to the marketing info on MediaTek’s website it is a quad-core, 64-bit ARM® Cortex-A35 core operating at up to 1.3 GHz.

Bottom centre of the board is the audio DAC which provides the output to the speaker.  A Texas Instruments TLV320DAC3100 low-power stereo audio DAC With Mono Class-D speaker amplifier.  The speaker connects to the PCB using two spring clips.

Along side the main components are several smaller IC packages that mainly deal with power regulation.  Most of them have markings that do not readily indicate what they are, but the three parts marked as 4NY are most likely LN1193 voltage regulators.

The processor board contains 56 test points. After lots of probing with a multimeter and oscilloscope we were able to determine the purpose of many of the test points. The table below shows a list of the test points and their purpose.

Components

USB FastBoot

On the Amazon Echo Dot there were two test points that could be connected to a USB cable for updating the firmware using FastBoot.

The Echo Flex contains a USB type A socket so to test if the same FastBoot method was available on the Flex we purchased a USB type A plug to type A plug cable.

The Echo Flex was turned on and the dot button was held down which on the other Echo models put the device into FastBoot mode.  After several seconds the LED turned green indicating that it had booted into the correct mode.  With device booted the linux command “lsusb -v” was run giving us a list of USB devices connected to the computer and in the list was a Mediatek device with the following details.

Bus 001 Device 002: ID 0bb4:0c01 HTC (High Tech Computer Corp.) Dream / ADP1 / G1 / Magic / Tattoo
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x0bb4 HTC (High Tech Computer Corp.)
  idProduct          0x0c01 Dream / ADP1 / G1 / Magic / Tattoo
  bcdDevice            1.00
  iManufacturer           1 MediaTek
  iProduct                2 Android
  iSerial                 3 xxxxxxxxxxxxxxxxx
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              256mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass     66 
      bInterfaceProtocol      3 
      iInterface              4 fastboot
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               1
Device Status:     0x0001
  Self Powered

Running the command "fastboot getvar all" returned the following:

root@echodev:~$ fastboot getvar all > fastboot.txt

(bootloader) 	antirback_tee_version: 0x0001
(bootloader) 	antirback_lk_version: 0x0001
(bootloader) 	antirback_pl_version: 0x0001
(bootloader) 	lk_build_desc: 674eac9-20190926_204255
(bootloader) 	pl_build_desc: 2b6f82c-20190926_204255
(bootloader) 	secure: yes
(bootloader) 	prod: 1
(bootloader) 	otu_code: xxxxxxxxxxxxx
(bootloader) 	unlock_status: false
(bootloader) 	unlock_code: xxxxxxxxxxxxxxxx
(bootloader) 	serialno: xxxxxxxxxxxxxxxxxx
(bootloader) 	max-download-size: 0x8000000
(bootloader) 	kernel: lk
(bootloader) 	product: CROISSANT
(bootloader) 	version-preloader: 0.1.00
(bootloader) 	version: 0.5
all: Done!!
finished. total time: 0.049s

As with the other two Echo devices we have disassembled the Echo Flex has a locked boot loader so without an unlock code and scatter file it would be impractical to update the firmware on the device.

Permalink