logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

RDA 5981AM/Broadlink BL3335-P - Generic/nobrand 15W RGBW B22 Bulb - basic teardown

Altirix 6666 200
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #151 21703891
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    Pull request - https://github.com/openshwprojects/OpenBK7231T_App/pull/1813
    Disable tuyamcu and dht.
    Kept aht2x and enabled wrapping printf functions for float printf.
    Need another ota test.
    @p.kaczmarek2
    I changed how "Prepare CI Environment" step is handled in workflow.
    If it builds a non-release version, then that step is skipped, saving about 30 sec.
    But i can't check if it would work for next release.
  • ADVERTISEMENT
  • #152 21703893
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12315
    I can merge it now and we will try on release version.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #153 21703897
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    Okay. Though i don't know if nanoprintf breaks RDA or not. Might release non-working RDA build.
  • #154 21703911
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12315
    We'll know once @divadiow tests. If there is a problem, I can remove this release, so we don't have polluted release history.
    Helpful post? Buy me a coffee.
  • #155 21703915
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    It didn't work i see, version wasn't overridden to release one.
    Fix is not working yet (#1815)
  • #156 21703917
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12315
    Ah ok, i can accept futher one. I'm available today whole day.
    Helpful post? Buy me a coffee.
  • #157 21703922
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    insmod wrote:
    Need another ota test.


    main_6083ddfca5f3
    Code: Text
    Log in, to see the code
  • ADVERTISEMENT
  • #159 21703933
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    insmod wrote:
    Does AHT2X print anything now?


    OpenRDA5981 system interface showing temperature and humidity data
  • #161 21703961
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    insmod wrote:
    Why is there 4 incomplete boots though?

    unsure of my exact steps, but every reboot adds +1 incomplete reboot until safe mode. then it'll always go into safe mode again on reboot even if you exit safe mode first.

    this is after running aht2x driver (ad-hoc - not in startup command), I'll wipe and see if incomplete count changes with no driver ever being run

    Added after 4 [minutes]:

    first boot after flash

    Code: Text
    Log in, to see the code


    second
    Code: Text
    Log in, to see the code


    etc

    Added after 2 [minutes]:

    so actually, nothing to do with driver running
  • ADVERTISEMENT
  • #163 21703983
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12315
    Looks like "boot is ok" event is not written?
    Helpful post? Buy me a coffee.
  • #164 21703989
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    insmod wrote:
    Fix for flash vars https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/18089628603

    first boot
    RDA 5981AM/Broadlink BL3335-P - Generic/nobrand 15W RGBW B22 Bulb - basic teardown

    second and all after = incomplete boots: 1

    OTA with same build =
    Code: Text
    Log in, to see the code


    Added after 9 [minutes]:

    a small side-effect of changing build file extension to .img is that the RDA tool only allows *.bin so requires manual *.* reveal first. just a point of note

    RDA 5981AM/Broadlink BL3335-P - Generic/nobrand 15W RGBW B22 Bulb - basic teardown
  • #166 21704024
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    insmod wrote:
    https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/18090104614

    failed
  • #168 21704049
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    insmod wrote:
    https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/18090969780

    Code: Text
    Log in, to see the code
  • #169 21704058
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    I'm giving up on OTA. There is no actual example of using it. Plus function docs says write address and buffer length must always be aligned to 1k.
    And what does rda5981_write_partition_end do? Just check crc? If so, then how does update is applied then?
    https://github.com/openshwprojects/OpenBK7231T_App/pull/1817
  • #171 21704083
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12315
    There is such sample:
    Code: C / C++
    Log in, to see the code


    Added after 47 [seconds]:

    Also in AliOS:
    https://github.com/brucetsao/AliOS-Things/blo...3b1/platform/mcu/rda5981x/hal/ota_port.c#L100
    Helpful post? Buy me a coffee.
  • #172 21704085
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    >>21704070
    It actually does, but there are still limits that i explained earlier.
    Flash write length, for example, must be aligned to 256 bytes
    https://github.com/ARMmbed/mbed-os/blob/d723b...GET_RDA/TARGET_UNO_91H/src/wland_flash.c#L142
    SDK was actually not needed.
    Almost everything is there in mbed-os main repo.

    Added after 4 [minutes]:

    I won't do it though, at least without having rda module on hand
    @p.kaczmarek2
    These need to be merged
    https://github.com/openshwprojects/OpenBK7231T_App/pull/1814
    https://github.com/openshwprojects/OpenBK7231T_App/pull/1817
  • #173 21720663
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12315
    Discussion about BG Electrical 822/HC-01 RDA5981A BL3335-P Module Double UK Smart Socket moved to:
    https://www.elektroda.com/rtvforum/topic4148862.html
    Helpful post? Buy me a coffee.
  • #174 21720715
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    thank you. now we need @Altirix to come back to have a go with backup and flash of the B22 bulb. Though if bulb is PWM I wonder if that'll be an issue

    Added after 1 [minutes]:

    insmod wrote:
    With config, sta and pins/pwm/uart

    though pwm support seems to have been added

    Added after 1 [minutes]:

    divadiow wrote:
    PWM seems to be OK. Dimmer works, colour picker works, warm/cold slider. LED dr in web app works.

    oh. and I did check it
  • #175 21726119
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    Got bootloader to work, and if OTA image is written manually - then upgrade occurs.
    The only thing left is to fix ota code in OBK, but that might be rather hard. rda5981_write_partition must be aligned to 1K.
    Code: text Expand Select all Copy to clipboard
    bootloader starts...
crc:0xa0fa6b33
firmware image valid
crc:0xc78cc364
upgrade image valid
current firmware is valid(ver:dev_20251020_165123)
upgrade is valid(ver:667916694)
firmware size 297598, after lzma decode 480008
crc:0x27cf9996
firmware crc 0x27cf9996(667916694), after lzma decode 0x27cf9996(667916694)
upgrade complete
update firmware information complete
erase image, addr: 0x18095000
boot from 0x18004000
boot user partition:0x18004000, pc:0x18018b59

----------------maclib task 
OpenRDA5981, version dev_20251020_165123
Entering initLog()...
Commands registered!


    Added after 1 [hours] 25 [minutes]:

    Semi-working OTA - https://github.com/openshwprojects/OpenBK7231T_App/pull/1839
    I get firmware image invalid after upgrade, even though it's working fine
    Code: text Expand Select all Copy to clipboard
    bootloader starts...
crc:0x3304f1f5
firmware image invalid
crc:0x657dbae8
upgrade image valid
bootloader starts...
crc:0x6affa22c
firmware image invalid
crc:0x657dbae8
upgrade image valid
firmware size 289910, after lzma decode 468160
crc:0x60353d1f
firmware crc 0x72f(1839_merge_655d0fc32777), after lzma decode 0x60353d1f(1614101791)
upgrade flash operation failed in copy upgrade firmware
boot from 0x18004000
boot user partition:0x18004000, pc:0x18018bc9

----------------maclib task 
OpenRDA5981, version 1839_merge_655d0fc32777
Entering initLog()...
Commands registered!


    Added after 33 [minutes]:

    Now with easyflash and littlefs
  • #176 21726237
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    hey great! nice

    you got yourself an RDA5981 I guess
  • #177 21726252
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    >>21726237
    BL3335-P from SP4L-US plug.
    It can't be easily disassembled, like UK or EU version. No screws. Destroyed it in the process.
  • #178 21726511
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    all for a good cause.

    need IO21 high for log? for flashing too or just power-on and rx/tx?
  • #179 21726631
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    >>21726511
    No need for IO21 at all

    Added after 5 [hours] 12 [minutes]:

    Since OTA is merged, here's the flasher
    https://github.com/openshwprojects/BK7231GUIFlashTool/pull/76

    Read works fine, occasional errors are there, but retry works fine. Hash checks every sector.
    Write is hacked, commands like "flash 1" "flash 5 2 4096 0 1" "flash 3" are sent without confirmation if they've worked, unlike original flasher.
    But it works for me just fine.
    Can't write only OBK config. If firmware is not flashed after, it will stop booting. So i disabled it, and "Automatically configure OBK on flash write" will write config before firmware flash.

    Read is like on RTL_Z2 (dump bytes)
    Code: text Expand Select all Copy to clipboard
    md.b 180F4000 4096
180F-4000: 1F 3F FF FF 45 46 34 30 FF FF FF FF FF FF FF FF    .?яяEF40яяяяяяяя    
...

    I did find an interesting alternative read command in ROM dump - "uploadb". But it's broken, adds some garbage at specific offsets. Plus it's not immediate.

    No baud change, only 921600. Second argument of "loadx"/"loady" commands allows baud change, but i wasn't able to get it to work.
  • #180 21726903
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12315
    Nice! IF you have issues with baud change, check UI code calls. I remember they caused issues for me in BL602. It turned out that addLog with Invoke is very, very slow. It halts thread and SerialPort does not react in time.
    Helpful post? Buy me a coffee.
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion revolves around the Broadlink BL3335-P smart bulb, which utilizes the RDA 5981AM chip. The original poster seeks information on the device and its components after peeling off the can to reveal the chip. They mention the bulb likely originated from AliExpress and express interest in moving away from proprietary firmware. Other participants inquire about the availability of a datasheet and suggest methods for obtaining a boot log, including using an Arduino for serial communication. They also note the existence of a similar module available on AliExpress (HLK-M50) and discuss the outdated nature of the available SDKs for the RDA5981AM chip.
Generated by the language model.
Today's popular

FAQ

TL;DR: 2 MB Tuya RDA5981 modules exist; “GPIO2 is used as log tx.” This FAQ distills BL3335‑P/RDA5981 teardown notes, SDK status, and dump tips. For modders migrating generic 15W RGBW bulbs off proprietary stacks. [Elektroda, insmod, post #21634746]

Why it matters: It shows how to identify the module, grab a boot log, and safely dump firmware when documentation is scarce.

Quick Facts

What chip is inside the Broadlink BL3335‑P smart bulb module?

A teardown shows the RF can covers an RDA5981AM Wi‑Fi SoC. The carrier PCB is marked BR3335, and the assembled module is sold as BL3335‑P. Photos in the thread reveal the die marking after peeling the shield. This identification aligns the bulb with the RDA5981 software ecosystem rather than ESP‑class parts. [Elektroda, Altirix, post #21434019]

Where can I find documentation for BL3335‑P and RDA5981AM?

Start with the FCC user manual for Broadlink BL3335‑P and the RDA5981AM datasheet. Both links are collected in the thread for quick access. The docs help with pinout, regulatory details, and SoC capabilities, which are essential for logging and firmware work. [Elektroda, Altirix, post #21434407]

Is there open-source firmware support for RDA5981 (OpenBeken/Tasmota/ESPHome)?

Active, mainstream support is not available. Builders have replaced the module with an ESP‑based board in similar bulbs due to the lack of open stacks targeting RDA5981. The thread opener invites contributors to attempt a port if interested. [Elektroda, Altirix, post #21434019]

How do I capture a boot log from an RDA5981 bulb or module?

Use a 3.3 V USB‑to‑serial (an Arduino in pass‑through mode works) and connect to RX/TX. Power the board at 3.3 V from a stable source. Open a terminal and reset the device to catch the early boot prints. [Elektroda, Altirix, post #21434407]

Which pin outputs logs on Tuya RDA5981 modules like WRD2L/WRD3S?

Tuya’s datasheet specifies GPIO2 as the log UART transmitter. Route your USB‑to‑serial RX to GPIO2 and common ground, then try standard baud rates. If silent, logs may be disabled in that build. [Tuya WRD3L Datasheet]

What RDA5981 SDKs exist, and are they viable today?

Public SDKs are dated Mbed OS 5.1.5 branches, and FreeRTOS isn’t provided. As one contributor puts it, “the sdks i’ve seen are very old.” Expect missing modern tooling and limited RTOS choices without vendor updates. [Elektroda, insmod, post #21434414]

How can I dump HLK‑M50 (RDA5981) firmware without duplication artifacts?

Use correct start address and 1 MB length to include the bootloader. The RDA Dump tool’s default vendor settings produce a 2044 KB file with repeated content on HLK‑M50. Adjust offsets to avoid mirrored dumps. [Elektroda, divadiow, post #21479530]

Why do I see no boot log or AP on an HLK‑M50 module?

One tester observed no UART output at any baud and no AP, only a brief power spike. That behavior suggests the image disables logs and soft‑AP or the device waits for external triggers. Verify power integrity and logging pins. [Elektroda, divadiow, post #21479538]

Are Tuya RDA5981 modules still available, and which models exist?

Yes, but they’re rare and expensive. Identified 2 MB variants include WRD2L, TYWRD2S, and TYWRD3S. The same source also lists other interesting Wi‑Fi/BLE modules stocked by the seller, but not RDA5981 alternatives at similar cost. [Elektroda, insmod, post #21634746]

Any useful tools or repos for working with RDA5981 images?

Check hfeasy for utilities and the RDA Dump tool used with Hi‑Flying modules. The thread includes sample dumps, boot strings, and notes on correcting dump bases to avoid duplicated images. [Elektroda, divadiow, post #21479530]

Can desoldering the module help identify GPIOs and signals?

Yes. If documentation is thin, remove the can or the module and inspect the underside for silkscreened GPIO labels. This is a practical way to map UART and control lines before wiring. [Elektroda, p.kaczmarek2, post #21434400]

Is anyone porting OpenBeken to RDA5981 right now?

A maintainer expressed interest but is prioritizing XR806 porting first. That places any RDA5981 work in a queue without a public timeline. Community test hardware and logs would help when development starts. [Elektroda, p.kaczmarek2, post #21434400]

What’s inside the generic 15W RGBW B22 bulb using BL3335‑P?

It’s an unbranded bulb, likely from AliExpress, carrying a Broadlink BL3335‑P module with an RDA5981AM under the RF can. Prior art shows people replacing the control board with ESP boards due to software support gaps. [Elektroda, Altirix, post #21434019]

Do boot strings reveal anything about the firmware base?

Captured strings include “airkiss‑2.0.0‑25360 (Dec 17 2015) ... ARM Cortex‑M3” and a build timestamp from December 2017. Those indicate legacy Broadlink stacks and toolchains, aligning with the older SDK landscape. [Elektroda, divadiow, post #21479530]

Where can I browse an RDA5981 SDK repository snapshot?

A GitHub mirror collects RDA5981 SDK material, including Mbed OS 5.1.5 based trees. It’s a starting point for analysis, though not a modern upstream. [Elektroda, divadiow, post #21434436]
Generated by the language model.
ADVERTISEMENT