logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Zemismart/Uascent ZML2-7W RGB+CW E27 LED Matter Bulb: Device and Module Insights [UAM026]

divadiow 1182 4
ADVERTISEMENT
Reply | New topic
  • Helpful post
    #1 21474600
    divadiow
    Level 35  
    Here's a high-level look at the Zemismart ZML2-7W RGB+CW E27 LED Matter bulb.

    Promotional offer for ZemiSmart smart LED bulb on AliExpress
    https://www.aliexpress.com/item/1005005646745391.html

    The dome pops off easily. It is not glued. The general feel and weight of the bulb is nicer/heavier than the standard cheap Tuya types.

    Packaging of ZGMISMART Matter smart LED bulb. Packaging of a Smart Matter LED bulb showing product specifications. LED bulb packaging with specifications. Box of ZMISMART Smart Matter LED Bulb on a wooden table. White ZemiSmart bulb on a wooden background. ZemiSmart LED bulb in packaging. ZML2-7W RGB+CW LED bulb lying on a wooden surface. Unscrewed smart LED bulb on a wooden table. Guide for pairing a bulb with Alexa and Google Home apps. ZEMISMART Smart LED Bulb user manual. ZEMISMART after-sale service business card with contact details. Close-up of the interior of an LED bulb with visible LEDs and electronic components on a circuit board. LED module with diodes and electronic components. Interior of an LED bulb with visible diodes and electronic circuitry. Circuit board with electronic components, including LEDs and an integrated circuit.

    The construction is a little more interesting than others I've dismantled. With the positive pin at the bottom removed, as with other bulbs, it became aparent when trying to pop off the metal edison screen base that the white plastic chassis would split apart also. This lower section has a thread and was siliconed into the top half. The neutral wire was sandwiched between the plastic and metal round the inside rim through the little U-shaped hole you see in the pic.

    The main PCB can be pulled backwards and out, leaving the LED disc in situ.

    Partially disassembled LED bulb on a wooden surface. Open plastic tool on a wooden table. Interior of a plastic cap with a visible spring inside.

    Once clear we can see the main PCB with Uascent UAM026 Beken BK7231N-based module. A CB3S type form factor but without the bottom row of contacts
    https://fcc.report/FCC-ID/2A68EJX-UAM026/

    Diagram of an integrated circuit with pin labels UAM026.

    UAM026-V1.0 electronic module with visible pins and markings.

    Printed circuit board with electronic component on a wooden surface. Circuit board with electronic components on a wooden background. Close-up of a printed circuit board with a 470µF 10V electrolytic capacitor. Circuit board with capacitors and integrated circuits. Components of a disassembled LED bulb on a wooden table. Electronic module with components on a wooden surface. Electronic module with components on wooden background Close-up of an electronic module with visible components including a transformer and capacitors. Electronic circuit board with components, including capacitors and transformer. Close-up of a green printed circuit board with a soldered electrolytic capacitor.

    Bright Power BP2516F LED driver IC on main PCB and a SiLLUMIN SL421A on the LED disc - another LED driver supporting dimming (why are there seemingly two LED drivers?)
    English Google translation datasheet attached
    https://www.sillumin.com/files/datasheet/SLM421A_Datasheet.pdf

    With all contacts accessible we can solder with the module left in place.

    Electronic module with connected wires on a worktable

    Boot log is from TXD1, not TX2 as with CB3S.
    Code: Text
    Log in, to see the code


    Easy Flasher key read shows coeff in efuse is 00000000 00000000 00000000 00000000 and from chats on Discord I expect this to really be 000s rather than a case of read-out disallowed. This means Zemismart, despite using the Uascent SDK (?) or is somehow related to Uascent, does not use the coeff we've seen on other Uascent devices: https://www.elektroda.com/rtvforum/topic4032988-30.html#21465033

    Read is successful in M mode or N mode with key check skip selected
    Screenshot of BK7231 Easy UART Flasher program with successful data reading.

    It is the case that the BK7231M OpenBeken release boots if flashed from 0x11000 (file offset 0x11000), so with the original device bootloader kept. Unlike other Uascents, the BL expects OTA partition to start at 0x132000 and not 0x143000. This also means OpenBeken OTA is not operational at present either.

    Screenshot showing a hex editor with data in hexadecimal and text format. Fragment of a screenshot from a hexadecimal editor displaying binary and text data.

    Like other Uascents, the CSA org ID is in the firmware - CSA23291MAT40804-24
    https://csa-iot.org/csa_product/zemismart-bulb/
    Attachments:
  • ADVERTISEMENT
  • #2 21476412
    p.kaczmarek2
    Moderator Smart Home  
    divadiow wrote:
    BL expects OTA partition to start at 0x132000 and not 0x143000. This also means OpenBeken OTA is not operational at present either.

    Have you tried to change this partition offset in the OBK SDK?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #3 21476425
    divadiow
    Level 35  
    not recently for this particular device. The wider issue remains though that the BL will have the non-Tuya standard OBK partitions so will always require a custom PR. It's still the case that we need a fully working QIO with standard BL partition layout and OTA working
  • ADVERTISEMENT
  • #4 21477454
    divadiow
    Level 35  
    Not finished but here's a bit more info.

    uHome+ app finds device for pairing
    Device auto-discovery screen showing detected Zemismart bulb. App screen showing the process of connecting a device to a network. Mobile app screen showing a connected device. Smart home management app interface with an enabled Zemismart bulb.

    App screen for managing a Zemismart smart bulb with a white light setting. Interface of an app for controlling a Zemismart smart bulb with color and brightness options. App interface with a countdown timer on a black background.

    shipped firmware version 2023/06/06_20:02:39 1.17 - after firmware update 2024/02/19_18:32:21 1.21

    Device information with ID, node identifier, addresses, and Zemismart bulb model. Device update screen offering to install a new version of the WiFi module v1.21. Device update screen with instructions and firmware download option.

    OTA file is retrieved from http://s3.us-east-1.amazonaws.com/prd-uagw/gw...20240528/17954059659446845441716893113968.ota

    Log output through OTA process
    Code: Text
    Log in, to see the code


    Added after 10 [hours] 4 [minutes]:

    OBK template
    Code: JSON
    Log in, to see the code


    and now module has been transplanted onto NiceMCU_WB3S_V1 board, in place of the BK7238, for further testing
    PCB module on a blue surface. Electronic module on a blue background with a QR code and markings. Electronic module with pin labels on a blue background.

    Added after 23 [minutes]:

    also worth adding that the FCC internal pics for this show the chip is labelled as a Belon BL2028N, a Beken BK7231N clone/rename
    https://fcc.report/FCC-ID/2A68EJX-UAM026/6803027

    Electronic module UAM026 with visible components and circuit board.
  • Helpful post
    #5 21485680
    divadiow
    Level 35  
    UAM026 added to NiceMCU mapping
    Diagram showing pin mapping for NiceMCU_WB3S_V1 and SparkleIOT XH-WB3S modules in relation to CB3S, WB3S, and UAM026.

    Added after 1 [hours] 9 [minutes]:

    Flashing BK7231N OBK rbl to 0x132000 does kick-off OTA to OpenBeken. Flashing the BK7231M release from 0x11000 with file offset 0x11000 also means a bootable OBK. These releases use the standard Tuya net info and OTA partition addresses so OTA will not work without further modification and the mac address of original firmware is not used.

    Screenshot of the OpenBK7231N web interface with various configuration options.

    I made a custom build where the OTA addresses are changed to match what's in the bootloader https://github.com/openshwprojects/OpenBK7231T_App/pull/1565/files
    Code: C / C++
    Log in, to see the code


    also the RF_FIRMWARE and RF_NET_PARAM to where they look to be for this device

    Code: C / C++
    Log in, to see the code


    original build: https://github.com/openshwprojects/OpenBK7231..._os/beken378/func/user_driver/BkDriverFlash.c

    and where OTA within OBK is flashed to in ota.h

    Code: C / C++
    Log in, to see the code


    then flashed the OpenBK7231M_QIO_1565_merge_32137ad28e3d.bin build file to 0x11000 file offset 0x11000 (to keep bootloader)

    sadly the mac is no different. BUT ota does work.

    queued up OpenBK7231N_1565_merge_32137ad28e3d.rbl to flash again to the device:

    OBK log
    Code: Text
    Log in, to see the code


    then on boot:

    Code: Text
    Log in, to see the code
Reply | New topic
Report a violation of the law
Popular Topics
ADVERTISEMENT