ITEAD: BN-SZ01 WiFi Round Flush Mount LED Ceiling Light – Part 2 – Hacking it

After getting the lamp to work correctly, I wanted to take it a step further, and put my own code on it. What I can see through the matte cover, this seems to be a bit more difficult. But let’s take a look inside and see if we can’t find them anyways.

Always remember!

Never power any device by using its own on board power supply. Always provide the correct voltage needed from either the USB port or battery. Connecting your computer while having the device powered by its own power supply, you can end up destroying your computer.

Let’s do this!

At first glance, it is clear that none of the pins are broken out for easy access, so we need to find the RX, TX, 3V3 and GND pins our self.

Finding pins

After a bit of poking around with my multimeter, I found a module on ITEAD’s wiki with what seems to be the same pinout as the one used in the lamp, even when they don’t have the same model number. The model I found was the PSF-B85, and this could make things a lot easier.

If I read this correct, the top row of connections on the module, is from left to right Reset, 3V3, TX, RX, GND. So let’s attach some wires and give it a try.

If you try things like this, using a current limited power supply, the chance of breaking something is reduced, but not eliminated. So it is always a good idea to have control over both voltage and current.

Here I have connected the four wires, and when applying 3.3v between the red and blue wire, the led turns on, and the device comes online in the EWeLink app, so everything seems to be running correctly.

GPIO0

To be able to flash our own code onto it, we need to get it into the correct mode, and to do that we need to pull GPIO0 down to GND. To do this I put an extra wire into the header connector on my TTL adapter, so I could keep GND connected to the module, and briefly connect it to GPIO0 on power up.

According to the wiki page, it should be the second from the bottom on the vertical column.

So I touched the wire to the pad, and connected the TTL adapter, and instead of the led coming on, nothing happened. This is a good sign!

In my “Flashing ESPEasy to the Sonoff 4CH” post I wrote about how to compile ESPEasy to the ESP8285, but once again, you can try just using the one I compiled https://github.com/blddk/esp8285/tree/sonoff_4ch which is exactly what I did. I am not going into details about how to connect the RX and TX pins, if you are not sure how to do it, consider looking at my post about doing this https://captain-slow.dk/2017/01/21/connecting-an-adapter-to-the-sonoff-switch-and-flashing-with-espeasy/

ESPEasy

After flashing the lamp with ESPEasy, I started looking at what was driving the leds in the lamp.

And what I found was a BP2838G, and in the datasheet it says “The BP2838G support a PWM dimming high precision buck constant current LED driver.”

Strange… They use a led driver which support PWM dimming, but they advertise the lamp as being undimmable. I wonder if they connected it to a wrong pin…? No, they connected it to GPIO12, which is a pin with PWM capability. Maybe it just isn’t working for some reason? And no… After plugging it into mains 230V and testing it, it works perfectly.

http://192.168.1.87/control?cmd=PWM,12,10 seems to be the lowest setting, anything below that makes no difference in the brightness. http://192.168.1.87/control?cmd=PWM,12,1024 is the setting for 100% duty cycle, and that works perfectly too, so I really wonder why they sell it as undimmable, because the hardware is perfectly capable of doing it.

openHAB

Setting it up in openHAB to control the light with a dimmer requires a bit more than just switching an output on and off, but it should pretty much be putting it in like this, maybe changing some names.

Items
Number Sonoff_Lamp_87_light			  		<light>		{mqtt=">[broker:/Sonoff Lamp 87/pwm/12:command:*:default]"}
Dimmer Sonoff_Lamp_87_dimmer	"Dimmer  [%.1f]"		<light>
Sitemap
Slider item=Sonoff_Lamp_87_dimmer
Rules
rule "Set light value"
when
	Item Sonoff_Lamp_87_dimmer changed
then
	var Number lightVal = Sonoff_Lamp_87_dimmer.state as DecimalType;
	lightVal = 10.24*lightVal;

	sendCommand(Sonoff_Lamp_87_light, lightVal)
end

The dimmer could have controlled the led directly, but  then you would not be able to set the light to 100% brightness. The reason for this is because the slider goes from 0 to 100, and the output for the led’s goes from 0 to 1024, and that is why we do 10.24*lightVal, so 100 on the dimmer will result in 1024 being send to the lamp instead of 100.

7 comments

  • Great! This convinced me to buy one, or two, as well. Thanks for breaking it down.

    A bit silly of them not to break out a simple 4 / 5 wire pin-header so they can sell to the hacker-aftermarket. Apparently 30% of their devices end up *not* connected to their Sonoff Basic cloud service, so that is a hacker market of many thousands of devices which could have been more easily sold.
    But alas: I am not a salesperson at itead.

  • If anyone else want to hack this –very bright!– led lamp, there is an easier way to supply power to the module. Saves you from soldering two little wires to the ESP8285 itself.
    The GND is connected to two pins on the BP2838G, and the 3.3V can be supplied to the big tab on the AMS1117. See image below:

    https://flic.kr/p/UdzEg6

    • Thank to Mikey and axello i was able to easily hack this with ESPEasy. not sure how i can get it working with amazon echo. or wait for the tasmota hack.

  • hey, thanks for the interesting info.
    How can I use the BZ-SZ01 as a replacement to an existing fixture with using its wall switch as well?
    I can see that connecting 3.3V pin to GND pin will turn on and off but this requires using a momentary switch, isn’t it so?
    Can you please elaborate on this?
    Will it cause damage if I use a momentary switch but will hold it in its ON position for a while?
    Thanks

    • I am not sure what you mean by connecting 3v3 to GND, there are not many cases where you want to short out a power supply.

      To use it as a normal lamp, I would either flash the microcontroller with ESPEasy and configure it to just turn the GPIO12 pin high on startup. Or I would solder a wire between the DIM (pin 2) on the BP2838G led driver chip, and 3v3.

      I have tried to leave the lamp turned all the way up for a few hours. It seems to get to a stable temperature around 78c.

  • in US with 110V with out the hack, turning on the LED, it would flicker. After the hack i was able to activate it with the ‘cmd=PWM,12,10’ command ‘,0’ to turn it off. but 1024 would again flicker. it would stay bright and steady ( or flicker my eye was not able to see) at 700. so my range was 0-700 for the slider.

    • Interesting! I wonder why that would make any difference. Maybe they drive the leds at a very high voltage, and it then is close to the input voltage, or something… I need to measure it next time I take it apart.

      Thank you for sharing your findings! 🙂

Leave a Reply