ITEAD: BN-SZ01 WiFi Round Flush Mount LED Ceiling Light – Part 2 – Hacking it

After getting the lamp to work correctly, I wanted to take it a step further, and put my own code on it. What I can see through the matte cover, this seems to be a bit more difficult. But let’s take a look inside and see if we can’t find them anyways.

Always remember!

Never power any device by using its own on board power supply. Always provide the correct voltage needed from either the USB port or battery. Connecting your computer while having the device powered by its own power supply, you can end up destroying your computer.

Let’s do this!

At first glance, it is clear that none of the pins are broken out for easy access, so we need to find the RX, TX, 3V3 and GND pins our self.

Finding pins

After a bit of poking around with my multimeter, I found a module on ITEAD’s wiki with what seems to be the same pinout as the one used in the lamp, even when they don’t have the same model number. The model I found was the PSF-B85, and this could make things a lot easier.

If I read this correct, the top row of connections on the module, is from left to right Reset, 3V3, TX, RX, GND. So let’s attach some wires and give it a try.

If you try things like this, using a current limited power supply, the chance of breaking something is reduced, but not eliminated. So it is always a good idea to have control over both voltage and current.

Here I have connected the four wires, and when applying 3.3v between the red and blue wire, the led turns on, and the device comes online in the EWeLink app, so everything seems to be running correctly.

GPIO0

To be able to flash our own code onto it, we need to get it into the correct mode, and to do that we need to pull GPIO0 down to GND. To do this I put an extra wire into the header connector on my TTL adapter, so I could keep GND connected to the module, and briefly connect it to GPIO0 on power up.

According to the wiki page, it should be the second from the bottom on the vertical column.

So I touched the wire to the pad, and connected the TTL adapter, and instead of the led coming on, nothing happened. This is a good sign!

In my “Flashing ESPEasy to the Sonoff 4CH” post I wrote about how to compile ESPEasy to the ESP8285, but once again, you can try just using the one I compiled https://github.com/blddk/esp8285/tree/sonoff_4ch which is exactly what I did. I am not going into details about how to connect the RX and TX pins, if you are not sure how to do it, consider looking at my post about doing this https://captain-slow.dk/2017/01/21/connecting-an-adapter-to-the-sonoff-switch-and-flashing-with-espeasy/

ESPEasy

After flashing the lamp with ESPEasy, I started looking at what was driving the leds in the lamp.

And what I found was a BP2838G, and in the datasheet it says “The BP2838G support a PWM dimming high precision buck constant current LED driver.”

Strange… They use a led driver which support PWM dimming, but they advertise the lamp as being undimmable. I wonder if they connected it to a wrong pin…? No, they connected it to GPIO12, which is a pin with PWM capability. Maybe it just isn’t working for some reason? And no… After plugging it into mains 230V and testing it, it works perfectly.

http://192.168.1.87/control?cmd=PWM,12,10 seems to be the lowest setting, anything below that makes no difference in the brightness. http://192.168.1.87/control?cmd=PWM,12,1024 is the setting for 100% duty cycle, and that works perfectly too, so I really wonder why they sell it as undimmable, because the hardware is perfectly capable of doing it.

openHAB

Setting it up in openHAB to control the light with a dimmer requires a bit more than just switching an output on and off, but it should pretty much be putting it in like this, maybe changing some names.

Items
Number Sonoff_Lamp_87_light			  		<light>		{mqtt=">[broker:/Sonoff Lamp 87/pwm/12:command:*:default]"}
Dimmer Sonoff_Lamp_87_dimmer	"Dimmer  [%.1f]"		<light>
Sitemap
Slider item=Sonoff_Lamp_87_dimmer
Rules
rule "Set light value"
when
	Item Sonoff_Lamp_87_dimmer changed
then
	var Number lightVal = Sonoff_Lamp_87_dimmer.state as DecimalType;
	lightVal = 10.24*lightVal;

	sendCommand(Sonoff_Lamp_87_light, lightVal)
end

The dimmer could have controlled the led directly, but  then you would not be able to set the light to 100% brightness. The reason for this is because the slider goes from 0 to 100, and the output for the led’s goes from 0 to 1024, and that is why we do 10.24*lightVal, so 100 on the dimmer will result in 1024 being send to the lamp instead of 100.

One comment

  • Great! This convinced me to buy one, or two, as well. Thanks for breaking it down.

    A bit silly of them not to break out a simple 4 / 5 wire pin-header so they can sell to the hacker-aftermarket. Apparently 30% of their devices end up *not* connected to their Sonoff Basic cloud service, so that is a hacker market of many thousands of devices which could have been more easily sold.
    But alas: I am not a salesperson at itead.

Leave a Reply