ITEAD: BN-SZ01 WiFi Round Flush Mount LED Ceiling Light – Part 2 – Hacking it

After getting the lamp to work correctly, I wanted to take it a step further, and put my own code on it. What I can see through the matte cover, this seems to be a bit more difficult. But let’s take a look inside and see if we can’t find them anyways.

Always remember!

Never power any device by using its own on board power supply. Always provide the correct voltage needed from either the USB port or battery. Connecting your computer while having the device powered by its own power supply, you can end up destroying your computer.

Let’s do this!

At first glance, it is clear that none of the pins are broken out for easy access, so we need to find the RX, TX, 3V3 and GND pins our self.

Finding pins

After a bit of poking around with my multimeter, I found a module on ITEAD’s wiki with what seems to be the same pinout as the one used in the lamp, even when they don’t have the same model number. The model I found was the PSF-B85, and this could make things a lot easier.

If I read this correct, the top row of connections on the module, is from left to right Reset, 3V3, TX, RX, GND. So let’s attach some wires and give it a try.

If you try things like this, using a current limited power supply, the chance of breaking something is reduced, but not eliminated. So it is always a good idea to have control over both voltage and current.

Here I have connected the four wires, and when applying 3.3v between the red and blue wire, the led turns on, and the device comes online in the EWeLink app, so everything seems to be running correctly.

GPIO0

To be able to flash our own code onto it, we need to get it into the correct mode, and to do that we need to pull GPIO0 down to GND. To do this I put an extra wire into the header connector on my TTL adapter, so I could keep GND connected to the module, and briefly connect it to GPIO0 on power up.

According to the wiki page, it should be the second from the bottom on the vertical column.

So I touched the wire to the pad, and connected the TTL adapter, and instead of the led coming on, nothing happened. This is a good sign!

In my “Flashing ESPEasy to the Sonoff 4CH” post I wrote about how to compile ESPEasy to the ESP8285, but once again, you can try just using the one I compiled https://github.com/blddk/esp8285/tree/sonoff_4ch which is exactly what I did. I am not going into details about how to connect the RX and TX pins, if you are not sure how to do it, consider looking at my post about doing this https://captain-slow.dk/2017/01/21/connecting-an-adapter-to-the-sonoff-switch-and-flashing-with-espeasy/

ESPEasy

After flashing the lamp with ESPEasy, I started looking at what was driving the leds in the lamp.

And what I found was a BP2838G, and in the datasheet it says “The BP2838G support a PWM dimming high precision buck constant current LED driver.”

Strange… They use a led driver which support PWM dimming, but they advertise the lamp as being undimmable. I wonder if they connected it to a wrong pin…? No, they connected it to GPIO12, which is a pin with PWM capability. Maybe it just isn’t working for some reason? And no… After plugging it into mains 230V and testing it, it works perfectly.

http://192.168.1.87/control?cmd=PWM,12,10 seems to be the lowest setting, anything below that makes no difference in the brightness. http://192.168.1.87/control?cmd=PWM,12,1024 is the setting for 100% duty cycle, and that works perfectly too, so I really wonder why they sell it as undimmable, because the hardware is perfectly capable of doing it.

openHAB

Setting it up in openHAB to control the light with a dimmer requires a bit more than just switching an output on and off, but it should pretty much be putting it in like this, maybe changing some names.

Items
Number Sonoff_Lamp_87_light			  		<light>		{mqtt=">[broker:/Sonoff Lamp 87/pwm/12:command:*:default]"}
Dimmer Sonoff_Lamp_87_dimmer	"Dimmer  [%.1f]"		<light>
Sitemap
Slider item=Sonoff_Lamp_87_dimmer
Rules
rule "Set light value"
when
	Item Sonoff_Lamp_87_dimmer changed
then
	var Number lightVal = Sonoff_Lamp_87_dimmer.state as DecimalType;
	lightVal = 10.24*lightVal;

	sendCommand(Sonoff_Lamp_87_light, lightVal)
end

The dimmer could have controlled the led directly, but  then you would not be able to set the light to 100% brightness. The reason for this is because the slider goes from 0 to 100, and the output for the led’s goes from 0 to 1024, and that is why we do 10.24*lightVal, so 100 on the dimmer will result in 1024 being send to the lamp instead of 100.

15 comments

  • Great! This convinced me to buy one, or two, as well. Thanks for breaking it down.

    A bit silly of them not to break out a simple 4 / 5 wire pin-header so they can sell to the hacker-aftermarket. Apparently 30% of their devices end up *not* connected to their Sonoff Basic cloud service, so that is a hacker market of many thousands of devices which could have been more easily sold.
    But alas: I am not a salesperson at itead.

  • If anyone else want to hack this –very bright!– led lamp, there is an easier way to supply power to the module. Saves you from soldering two little wires to the ESP8285 itself.
    The GND is connected to two pins on the BP2838G, and the 3.3V can be supplied to the big tab on the AMS1117. See image below:

    https://flic.kr/p/UdzEg6

    • Thank to Mikey and axello i was able to easily hack this with ESPEasy. not sure how i can get it working with amazon echo. or wait for the tasmota hack.

  • hey, thanks for the interesting info.
    How can I use the BZ-SZ01 as a replacement to an existing fixture with using its wall switch as well?
    I can see that connecting 3.3V pin to GND pin will turn on and off but this requires using a momentary switch, isn’t it so?
    Can you please elaborate on this?
    Will it cause damage if I use a momentary switch but will hold it in its ON position for a while?
    Thanks

    • I am not sure what you mean by connecting 3v3 to GND, there are not many cases where you want to short out a power supply.

      To use it as a normal lamp, I would either flash the microcontroller with ESPEasy and configure it to just turn the GPIO12 pin high on startup. Or I would solder a wire between the DIM (pin 2) on the BP2838G led driver chip, and 3v3.

      I have tried to leave the lamp turned all the way up for a few hours. It seems to get to a stable temperature around 78c.

  • in US with 110V with out the hack, turning on the LED, it would flicker. After the hack i was able to activate it with the ‘cmd=PWM,12,10’ command ‘,0’ to turn it off. but 1024 would again flicker. it would stay bright and steady ( or flicker my eye was not able to see) at 700. so my range was 0-700 for the slider.

    • Interesting! I wonder why that would make any difference. Maybe they drive the leds at a very high voltage, and it then is close to the input voltage, or something… I need to measure it next time I take it apart.

      Thank you for sharing your findings! 🙂

  • I don’t suppose you have more on the specific settings for these lights with ESP_Easy?

    I bought 8 of the lights on special and have the firmware installed but so far haven’t been able to figure out the ESP_Easy settings. I have programmed Sonoff POW units in the past but that was simpler firmware.

    • I haven’t set anything special. The only thing I set was the WiFi settings so it could log on to my WiFi.

      • Ok, thanks for the info. So under the Hardware page you just left everything as default I guess.

        I have tried to enable MQTT so I can hopefully control with Home Assistant but can’t see anything coming into my MQTT broker.

        Not much info on these devices so I will have to keep messing around until I figure it out.

        • Just make sure to enable the right type of borker and it should work fine.

          Under hardware I set D6 and D7 to be Output Low, and WiFi status led to be D7.
          I use Mosquitto for MQTT, and to get that working I use the Openhab MQTT protocol under config.

  • I was never succesful switching lights on with Domoticz using ESPEasy and MQTT. With ESPEasy I always use the http commands. The Espurna firmware works better with the Domoticz’ type of MQTT signals.

  • I ended up replacing the Easy ESP firmware with the Transmota firmware. Now I have MQTT working and easier integration with Home Assistant. I have dimming from the web server installed in the light with Transmota and last step is just to get the dimmer working from Home Assistant and hopefully from Alexa.

    This site is definitely the most useful for me for learning how to connect the light up for programming. Thanks!

  • One of the comments posted suggest that it would work with 110V (US). The specs however mention 180V-264V. Does it work with 110V?

  • I flashed Tasmota firmware on it. With 220V everything works as expected. However with 110V the device doesnt even make a DHCP request.

Leave a Reply