logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Sonoff B02-F-A60 Retro/Antique Filament Bulb Teardown and Module Findings [SV6166F] [RM9012GB]

divadiow 4311 5
ADVERTISEMENT
Reply Cool? Ranking DIY | New topic
Notify about new articles
  • Here's my destructive exploration into the module used in retro/antique/filament Sonoff B02-F-A60 available from Ali Express https://www.aliexpress.com/item/1005004755054049.html

    Sonoff B02-F-ST64 LED filament bulb with E27 base for 220-240V, shown on an online store product page.

    Sonoff ship these in decent packaging because they're glass. It arrived in a thick pillowed envelope as well as the box with plastic inner shell.

    Sonoff B02-F-A60 LED filament bulb and its original packaging on a carpet. Sonoff B02-F-A60 Wi-Fi LED bulb box with features and technical specifications. Blue box of Sonoff B02-F-A60 Wi-Fi LED bulb with drawing and technical information on the package. Sonoff B02-F-A60 filament bulb in its box with the user guide visible. LED light bulb with transparent glass lying on a carpet. Close-up of an LED light bulb lying on a beige carpet, showing the screw base and internal components. A person holding a transparent Sonoff Wi-Fi bulb with visible technical markings and certifications.

    I believe the hard foam/glue is a phenol-formaldehyde resin so will be hard to soften/dissolve. I heated the metal fitting and finally managed to pop it off. It broke the LED filament wires as it came apart. The PCB with power converter, capacitors and wifi module is buried in more resin, the metal fitting and a plastic ring. Further removal was destructive. I'm not putting this back together.

    A broken LED bulb lying on a light-colored carpet. A rusty metal base of a glass light bulb against a blue surface. Damaged internal electronic component of an LED spotlight with visible corrosion and wires. Damaged LED bulb with exposed burnt electronic components and debris. Close-up of a damaged and corroded electronic circuit board with visible rust, debris, and a protruding white wire. Lamp socket component and its parts on a blue mat, surrounded by small debris. Close-up of the inside of an electronic component with removed casing, showing capacitors. Interior of an LED bulb showing visible electronic components. Close-up of a damaged and partially disassembled electronic power supply with visible components and burn residues. Small circuit board with yellow capacitors and other electronic components on a blue background. A damaged electronic module covered with brown corrosion or residue on a blue surface. Interior of an electronic module with visible capacitors and brown residue, likely a damaged LED bulb circuit.

    After scraping enough resin away the module is de-soldered

    Sonoff B02-F Wi-Fi module with visible IC and QR code on white PCB, partially dirty with resin residue. RE705-MB-v0.1 circuit board module with exposed electronic components and resin residue. Electronic module with SV6166F chip and pin markings on a blue background. Close-up of an electronic module with a 25.0 MHz crystal oscillator, mounted vertically in front of a ceramic base. Close-up of a PCB module with SV6166F chip removed from a Sonoff lamp, placed on a blue surface.

    The MCU is an Icomm-Semi SV6166F (aka CKW04) - the subject of previous musings here https://www.elektroda.com/rtvforum/topic4086605.html

    Module RE705-MB-v0.1 also seen here and probably in a few other Sonoff devices: https://fcc.report/FCC-ID/2APN5B02FA19/5455362

    The ESOP8 chip is a Reactor-Micro RM9012GB LED driver - datasheet attached

    Close-up of a Reactor-Micro RM9012GB chip on a PCB, partially covered by brown resin.

    Before continuing I traced every pad/contact:
    Close-up of Sonoff RE705-MB-v0.1 PCB with SV6166F chip, labeled GPIO pins, and a pinout diagram. Close-up of the Sonoff RE705-MB-v0.1 module with labeled UART, GPIO, and HSD pins, partially cleared of resin.

    so from UART1_TX at 921600 baud we have this log:

    Code: Text
    Log in, to see the code


    I was able to enter the boot menu by sending the "m" character at power-on, as shown in boot log.

    Code: Text
    Log in, to see the code


    Unfortunately I hit "x" next which went straight into erasing the flash and waiting for an upload of new firmware
    Code: Text
    Log in, to see the code


    so that's the factory firmware gone :/

    this boot menu/ xmodem and CCCCC console output is very similar to the serial port firmware upgrade step shown in the Hi Flying HF-LTPx30 upgrade document High Flying Wi-Fi Module Operation Guide_20200814.pdf

    A screenshot showing firmware update instructions for the HF-LPBX30 bootloader, its command menu, and file upload via Xmodem in a terminal program.

    I think my next step will probably be to attempt an upload of something - maybe the HF-LPD1x0 firmware supplied here http://www.hi-flying.com/download-center-1/firmware-1/download-item-hf-lpd1x0-firmware
    Attachments:

    Cool? Ranking DIY
    About Author
    divadiow
    Level 34  
    Offline 
    divadiow wrote 2826 posts with rating 488, helped 253 times. Live in city Bristol. Been with us since 2023 year.
  • ADVERTISEMENT
  • #2 21520513
    p.kaczmarek2
    Moderator Smart Home  
    Interesting, I've known Sonoff products for BL602 usage, but not for SV6166F. Still, SV6166F doesn't seem to be new, I see mentions dating back to 2019:
    Google search result showing an article about the iCommSemi SV6166F, a low-power WiFi SoC for IoT.
    See: https://www.cnx-software.com/2019/12/12/icomm...-andes-risc-soc-for-iot-and-embedded-systems/
    MCU – Andes Technology N10 processor with ILM/DLM and I-cache.
    Memory & Storage:
    - 128K ROM and 192 KB SRAM for Instruction and data SRAM in total
    - 8K retention SRAM
    - 2MB (16 Mbit) SPI flash in package
    - Flash and PSRAM controller up to 16MB/64Mb with XIP
    I wonder if you'll be able to flash any new firmware to that, even a hello world, this could be a first step to porting OBK, if there is an SDK.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #3 21520521
    divadiow
    Level 34  
    yes indeed.

    I'm sending various HF firmware to it now to see which boot if any
    Screenshot of SecureCRT software displaying a binary file transfer over a serial port using the Xmodem protocol.

    Added after 18 [minutes]:

    these do not

    A list of five firmware BIN files starting with LPD, showing name, date, type, and size details.
  • ADVERTISEMENT
  • #4 21520720
    p.kaczmarek2
    Moderator Smart Home  
    Do we have any firmware backup from other SV6166F device to try flashing?

    I can see that SV6166F was also used in Sonoff B02-B-A60 bulbs at some point:
    Two Sonoff Wi-Fi smart LED bulbs, models B02-B-A60 and B05-B-A60(RGB), on a white background.
    产品参数表-B02-...201016.pdf Download (1.36 MB)

    What is DP, DM? For a moment I hoped for USB, but I see no mentions of that on the diagram:
    Block diagram of a Wi-Fi module with interfaces, memory, power, and I/O connections.

    This chinese document (Alios SDK?) mentions BK7231, BK7231S, BK7231U along with SV6166F, SV6166, SV6266:
    开发指南_cn_z..CN.pdf Download (26.96 MB)
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #5 21520729
    divadiow
    Level 34  
    regarding your other post https://www.elektroda.com/rtvforum/topic4086605.html#21520722, apologies, there's a little side exploration I tried with this Sonoff module regarding USB that I neglected to mention.

    With that USB program in mind, I hooked up D- and D+ pads to a USB cable I cut up in the hope it would detect as something, even an unknown device, in Windows for use with that program. That seemed like the most likely way I could read the flash and then maybe flash whole chip, including BL, if necessary. Sadly nothing was detected.

    I have not been able to find a firmware dump from a proper Sonoff SV6166F device - yet.

    Added after 56 [minutes]:

    yes. I think I should focus on the USB function. Also, why are GPIO14/15 exposed as test pads on this module? What purpose do they serve? Could pulling one, the other, or both low put it into USB download mode or something? I'll investigate.

    Added after 35 [minutes]:

    the module might actually be by Shenzhen Water World Co., Ltd. There are other RE7xx modules in FCC docs with SV6166F chips https://fcc.report/company/Shenzhen-Water-World-Co-L-T-D

    eg the RE730 https://fcc.report/FCC-ID/2AYCN-RE730
    Blue Sonoff SV6166F electronic module with visible chip, traces, and antenna, placed on an anti-static mat.

    Added after 8 [hours] 49 [minutes]:

    this curious arrangement is HSDP/HSDM to USB via 10ohm resistor, TX/RX to terminal and tails for GPIO14/15. No sign of any USB life in Windows with any GPIOs tried low

    An electronic board connected to a USB hub with multiple wires on a workbench.
  • #6 21532820
    divadiow
    Level 34  
    Paired with eWeLink app
    eWeLink app screen showing found device SONOFF B02-F ready to add. App screen showing device pairing progress with Wi-Fi, including a 60% circular progress bar. Screenshot of the eWeLink app showing device B02-F turned ON in the My Home section. eWeLink app screen controlling a Sonoff bulb, with the brightness slider set to 100%. Device settings screen in the eWeLink app showing details for a SONOFF B02-F smart device. Device settings screen in the eWeLink app, displaying details for a SONOFF device.
    WTW-SNL-02
Reply Cool? Ranking DIY | New topic
Notify about new articles
Report a violation of the law
Popular Topics
ADVERTISEMENT