logo elektroda
logo elektroda
X
logo elektroda

RDA 5981AM/Broadlink BL3335-P - Generic/nobrand 15W RGBW B22 Bulb - basic teardown

Altirix 696 14
ADVERTISEMENT
  • Helpful post
    #1 21434019
    Altirix
    Level 2  
    I'm posting as there seems to be a very limited amount of info on this device and chip being used, A Broadlink BL3335-P, (carrier PCB says BR3335, the actual module has no part number)

    Close-up of a smart bulb interior showing LEDs and a Broadlink module.

    Anyway I was curious as to what the actual controller was so as you can see I peeled the can off. this presents the RDA 5981AM.

    View of the inside of a smart bulb with an exposed RDA 5981AM module.

    Unfortunately I'm not exactly sure where the bulb was from, I've had it for a while and only recently took a look inside. It's most likely one off AliExpress and I'm pretty sure they switched to another controller now as I've ordered twice from the same store a few years later. There is no branding on the side of the bulb.

    Others seem to have got the same or similar boards such as https://diy.viktak.com/2020/05/broadlink-smart-bulb-conversion-to-open-source.html and were able to make a custom board for an esp as there's no project that supports the controller, likely due to it being obscure.

    If anyone wants to try and support this controller in OpenBeken or any others and would like to get anything off the device that would be useful in supporting you, feel free to message
  • ADVERTISEMENT
  • #2 21434400
    p.kaczmarek2
    Moderator Smart Home
    Very interesting, I haven't seen that one yet. I could give it a go, but for now, I'm doing porting for XR806, so it would have to wait a bit in the queue.

    Anyway, were you able to find a datasheet for this module or chip?

    Did you attempt to take a boot log of this device? It could tell us which SDK was used.

    If there is no documentation for used WiFi module, then maybe we can desolder it with hot air just to check the GPIO markings on the back.
    Helpful post? Buy me a coffee.
  • #3 21434407
    Altirix
    Level 2  
    p.kaczmarek2 wrote:

    Very interesting, I haven't seen that one yet. I could give it a go, but for now, I'm doing porting for XR806, so it would have to wait a bit in the queue.


    No worries, in no rush myself, was trying to find info on what I had to start moving them away from their proprietary firmware. and noticed it seemed to be unknown to those who work on these open projects.

    p.kaczmarek2 wrote:

    Anyway, were you able to find a datasheet for this module or chip?


    Yes, seems the blog post states they were unable to find documentation (however they supposedly had a Broadlink BL3336T-P) there does seem to be documentation for the Broadlink BL3335-P and RDA 5981AM it's using.

    https://fccid.io/2ACDZ-BL3335-P/User-Manual/User-Manual-3825022.html

    https://github.com/RDA5981/RDA5981/blob/master/Datasheet/RDA5981AM DataSheet V1.5.pdf

    p.kaczmarek2 wrote:

    Did you attempt to take a boot log of this device? It could tell us which SDK was used.


    I have not, how would you recommend getting a boot log from one of these?

    Edit: could probs use an arduino as a usb to serial and connect to the rx and tx then power the board with 3.3v. and that should spit out a boot log?
  • #4 21434414
    insmod
    Level 26  
    If someone is interested in trying to port, a module with this chip is available at aliexpress, (HLK-M50).
    I don't see a point though, the sdks i've seen are very old, last version publicly available is at least 8 years old (RDA5981_SDK_MbedOS515_V1.3.5).
    On csdn there are mentions of RDA5981_SDK_MbedOS515_V1.3.6 and RDA5981_SDK_MbedOS515_V2.0, but you cannot download them (china only site).
    And not to mention there is no freertos in any of those sdk.
  • ADVERTISEMENT
  • ADVERTISEMENT
  • #6 21479530
    divadiow
    Level 35  
    I think I've nailed the correct starting address (includes BL) and length for 1mb flash on HLK-M50
    Screenshot of RDA Dump Tool version 1.00.01.

    Screenshot showing a hexadecimal code snippet and its decoded text.

    Code: Text
    Log in, to see the code

    Code: Text
    Log in, to see the code


    useful: https://github.com/ljalves/hfeasy

    without modification RDA Dump tool loads with these addresses set by Hi-Flying. These addresses result in a 2044kb file dump, which clearly shows HLK-M50 flash content repeated.

    RDA Dump Tool program for data dumping on a computer.

    Tool and dump will also land in FlashDumps and FlashTools GH
  • #7 21479538
    divadiow
    Level 35  
    and I've not seen any boot log output on either UART at any baud, no AP either. Only a small power spike at start to suggest it's doing anything

    Electronic module with a USB cable connected on a wooden table.
  • #8 21634746
    insmod
    Level 26  
    Found several Tuya 2MB RDA5981 modules on ali. WRD2L, TYWRD2S and TYWRD3S. However, they are very expensive, probably due to their rarity.
    https://aliexpress.com/item/1005008924925369.html
    https://aliexpress.com/item/1005008015024930.html
    https://aliexpress.com/item/1005008064774207.html
    Shop has more different/interesting modules. (Like LN882H WL2H-U, ZS3L, TYZS3, WR3E, WB3L (the one with P16)). W500 chip, but sadly no module.
    And there are still datasheets.
    https://developer.tuya.com/en/docs/iot/wrd2l?id=K97rncgxgum9h
    https://developer.tuya.com/en/docs/iot/wrd3l-datasheet?id=K98d49g38w0uc
    Tuya mentions that GPIO2 is used as log tx.

    I wonder if Tuya still has the SDK?
  • #9 21634810
    divadiow
    Level 35  
    insmod wrote:
    I wonder if Tuya still has the SDK?


    no sign of it.
    searches have been:

    RDA5981X
    RDA5981BM
    RDA598X
    RDA5980
    RDA5981

    upper/lowercase

    then _major.minor 0.0-3.9 and _major.minor.build for 0.0.0->3.99.99

    then extensions .zip and .tar.gz upper and lowercase

    the correct platform name is usually the bit seen at the end of this string after AT, so a boot log from Tuya device would help, but I haven't found one.

    < TuyaOS V:3.8.31 BS:40.00_PT:2.3_LAN:3.5_CAD:1.0.5_CD:1.0.0 >
    < BUILD AT:2024_12_26_11_42_43 BY ci_manage FOR tuyaos-iot AT T1 >
  • #10 21634815
    insmod
    Level 26  
    >>21634810
    RDA5981B?
    upper/lowercase doesn't matter in http.
  • #11 21634822
    divadiow
    Level 35  
  • ADVERTISEMENT
  • #13 21634861
    insmod
    Level 26  
    According to datasheet, flash address is 0x1400000, and rom address is 0x0 with 0x10000 length.
    0x1800000 is i-cache, which i guess is flash but for xip?
  • #15 21637578
    divadiow
    Level 35  
    re-ran with new major.minor and major.minor.build

    :(

    RDA 5981AM/Broadlink BL3335-P - Generic/nobrand 15W RGBW B22 Bulb - basic teardown

Topic summary

The discussion revolves around the Broadlink BL3335-P smart bulb, which utilizes the RDA 5981AM chip. The original poster seeks information on the device and its components after peeling off the can to reveal the chip. They mention the bulb likely originated from AliExpress and express interest in moving away from proprietary firmware. Other participants inquire about the availability of a datasheet and suggest methods for obtaining a boot log, including using an Arduino for serial communication. They also note the existence of a similar module available on AliExpress (HLK-M50) and discuss the outdated nature of the available SDKs for the RDA5981AM chip.
Summary generated by the language model.
ADVERTISEMENT