logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

divadiow 1302 21

TL;DR

  • A Re-Use shop haul turned up four smart bulbs: IKEA Tradfri E27 LED2003G1, Ener-J SHA5262 WiFi A60, an unmarked PIR E27/A60, and an unbranded RGBWW BLE+2.4G.
  • The unbranded bulb is a Zengge design using a YiChip YC1166 MCU, an SM2135EH LED driver, and a BY4-M5 V1.1 module.
  • The shop sold the bulbs for £1 for 4, or 25p each.
  • Pairing was unreliable: rapid on-off-on-off-on-off sometimes enabled setup, only the Zengge app found it, and it stopped responding after a couple of toggles.
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • In the city where I live we have "Re-Use" shops alongside standard recycling centres (aka tips, dumps, household waste disposal facilities). These re-use centres are packed with donations and finds that would otherwise have gone into the general waste or recycled. Of course there's some stuff for sale that should probably have been binned, but a lot is fairly decent.

    This Re-Use centre in particular has 6 drawers of light bulbs.
    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT
    and at £1 for 4 bulbs, £0.25p each, there's potential to find some interesting smart bulbs in amongst the boring fluorescent or incandescent mix for a bargain price
    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    I found my 4. There didn't appear to be any more worth having.

    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    1 Ikea Tradfri E27 LED2003G1
    1 Ener-J Smart WiFi A60 SHA5262 9w
    1 unmarked E27/A60 with PIR dome
    1 unbranded 10w RGBWW BLE+2.4G

    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT



    I started with the generic RGBWW BLE+2.4G

    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    This is Zengge device with YiChip YC1166 MCU at its heart on a module marked 
    BY4-M5 V1.1
    .

    YC1166 Yichip Microelectronics (Hangzhou) Co., Ltd.

    Radio:
    Bluetooth 5.0 BR/EDR/BLE
    Also described as supporting proprietary 2.4 GHz operation
    2.4 GHz ISM band, single-ended RFIO
    Advertised data rates: 250 kbps, 1 Mbps, 2 Mbps, 3 Mbps
    BLE sensitivity quoted around -95 dBm
    TX power quoted up to +9 dBm

    CPU / architecture:
    Dual-core digital architecture
    Application core: ARM Cortex-M0, up to 48 MHz
    Link-management core: 32-bit custom/RISC core
    M0 memory listed as 16 KB Data RAM + 16 KB cache / code RAM
    Link core memory listed as 80 KB ROM, 64 Kbit OTP, 8 KB patch RAM and 8 KB data RAM

    Flash / storage:
    Internal QSPI-connected 4 Mbit/512 KB internal flash

    On the LED disc we have an SM2135EH - a 5-channel intelligent dimming LED constant current driver for low power LEDs. The DAT/CLK pads on the rear of the bulb's main PCB unfortunately go to the SM2135H and don't appear to be for use in programming the YC1166, which seems to use some proprietry single-wire protocol. Yichip bluetooth MCUs are programmed through the dedicated ICE/IO31 pin.

    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    I've not found much about this ICE pin apart from that a Yichip programmer has appeared on Ali Express before https://www.digitalworldz.co.uk/threads/yichip-programming.477322/post-2786057

    To my surprise IO31 had a debug log out at 921600 baud:
    Code: Text
    Log in, to see the code


    interesting, "PPlus_SUCCESS" is seen in PHY code.

    For the bulb's operation, pairing mode seem to be achievable with rapid on-off-on-off-on-off action, but even then it was pretty hit-and-miss.

    Only the "Zengge" named app of all the Zengge-made apps seemed to pick it up. It would stop responding after a couple of on/offs.

    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    nRF Connect
    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    other markings:
    ZJ-PWH-RGBWW-L2 V1.1
    CH-323L-009A
    ZJ-LB-BWPWH-RGBWW-L1

    I'll work through the others next and post further updates as and when I can
    Attachments:
    • YiChip_YC1166.pdf (1.27 MB) You must be logged in to download this attachment.

    Cool? Ranking DIY
    About Author
    divadiow
    Level 38  
    Offline 
    divadiow wrote 4904 posts with rating 871, helped 429 times. Live in city Bristol. Been with us since 2023 year.
  • ADVERTISEMENT
  • Helpful post
    #2 21897152
    divadiow
    Level 38  
    Posts: 4904
    Help: 429
    Rate: 871

    second bulb. let's get this potentially non-smart one out of the way.

    and .. it's a basic PIR LED bulb :(

    Disassembled LED bulb with PIR motion sensor and an exposed circuit board moduleClose-up of an LED PCB with a PIR module and markings “PIRCVDY-8P-V5” and “PIRCVDB-8P-V2”Close-up of a PIR sensor PCB with a TO-5 metal can and SMD ICs, mounted over an LED bulbClose-up of a PIR sensor PCB in front of a disassembled LED bulbDisassembled PIR LED bulb parts: reflector housing, Fresnel lens, and PCB with red and black wires on blue matClose-up of a PCB with transformer, capacitors, and an IC on a blue backgroundClose-up of an LED driver PCB with transformer, capacitors, and marking PIRCVDY-8P-V5Close-up of LED bulb electronics: PIRCVDY-8P-V5 board on a round SMD LED module with transformer belowClose-up of LED PCB with four SMD LEDs and “PIRCVDY-8P-V5” marking plus +/− solder padsPCB module with 1A21-Z PIR sensor and SMD chips, held between fingersClose-up of a PIR sensor PCB with a metal can sensor and SMD chips, held in a hand

    markings:
    PIRCVDY-8P-V5
    PIRCVDB-8P-V2
    2PH110122A
    MX8198H (Sinotech Mixic) (related to MX8098 - a SOP8 pyroelectric infrared/PIR control IC for passive infrared motion detection?)

    1A21-Z (Tranesen Optoelectronics Co., Ltd)
    Code: Text
    Log in, to see the code

    https://roboparts.ru/upload/iblock/493/493fc13e4e254a79251e138edb414ac2.pdf

    the next two bulbs should be more interesting

    Added after 11 [hours] 26 [minutes]:

    this one is.

    Ener-J SHA5262 - https://enerjsmart.co.uk/products/smart-colou...light-bulb-single-pack?variant=42590800347381

    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BTRound LED PCB with SMD LEDs in a ring and a small IC on a blue work matInside an LED bulb showing a PCB with a capacitor and a white labeled moduleGreen PCB with WB3L wireless module, capacitors, and a pin header on a blue work matGreen PCB with SMD components on a blue surface, with two wires exiting at the bottomClose-up of a PCB with SMD components and an SOIC integrated circuit on a blue backgroundCircuit board with capacitors, a wire lead, and a shielded RF module on a blue work matClose-up of a PCB with capacitors, a small transformer, and a shielded radio module on a blue work matSmall PCB with Wi‑Fi module, capacitors, transformer, and colored wires on a blue work matTwo electronic boards connected by wires on a blue work mat

    My first WB3L - a nice older Beken BK7231T module
    Pinout diagram of WB3L module with labels for GPIO, UART, I2C, SPI, PWM, ADC, and power pins

    from TX2:
    Code: Text
    Log in, to see the code


    Pairs with Tuya
    “Add Device” screen showing ENERJ Smart Bulb A60 added successfully and a “Done” button.

    schema: 00000149dc
    keytg5kq8gvkv9dh
    pfyewd04anarmjjy

    and Tuya KV:
    Code: JSON
    Log in, to see the code


    Code: Text
    Log in, to see the code


    OBK template
    Code: JSON
    Log in, to see the code


    markings:
    BP5778
    EL-A60-10X2 V7.7
    EL-DY-245 V7.1
    BP2513D
  • #3 21897908
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14459
    Help: 650
    Rate: 12468
    Very interesting, we don't have such place in my city. So, since YC1166 is Bluetooth chip, can our OBK BT ESP gateway see it?

    Was WB3L bulb already paired before?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #4 21897922
    divadiow
    Level 38  
    Posts: 4904
    Help: 429
    Rate: 871
    p.kaczmarek2 wrote:
    So, since YC1166 is Bluetooth chip, can our OBK BT ESP gateway see it?


    good question. I didn't check. I should play with btproxy release because I'm a little unclear of its setup/use, what its limitations are etc.

    p.kaczmarek2 wrote:
    Was WB3L bulb already paired before?

    yes

    the previous owner's AP SSID and password are in the dump, but they're pretty anonymous generic Zyxel factory credentials it seems

    Final bulb, the IKEA Tradfri, is in pieces now on the workbench...
  • #5 21897999
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14459
    Help: 650
    Rate: 12468
    I'm curious to see what you''find there! For those prices, it seems like a great deal. Do they have other smart devices, too?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #6 21898055
    divadiow
    Level 38  
    Posts: 4904
    Help: 429
    Rate: 871
    p.kaczmarek2 wrote:
    For those prices, it seems like a great deal


    yes. bulbs seemed particularly cheap at that centre. Probably they needed to make them an attractive price so they aren't kept around for long, and the smart ones were just thrown in with the less interesting ones. I can't imagine the staff caring much or having enough time to really notice the difference between bulbs.

    p.kaczmarek2 wrote:
    Do they have other smart devices, too?


    mostly audio stuff, xbox, keyboards, monitors etc. If there were interesting IoT devices I probably would have grabbed them!

    I'm driving past a different Re-Use centre today... 😈
  • #7 21898502
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14459
    Help: 650
    Rate: 12468
    This way you can get WiFi modules cheaper with whole bulb than buying a WiFi module separately.

    Cool, did you find anything more interesting?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #8 21898525
    divadiow
    Level 38  
    Posts: 4904
    Help: 429
    Rate: 871
    Negative. One sad tray of standard bulbs today. Hardly any electronics. Disappointing.
  • #9 21899161
    divadiow
    Level 38  
    Posts: 4904
    Help: 429
    Rate: 871
    The TRÅDFRI LED2003G10 (Zigbee, E27 globe, 1055lm, 9.5W, white spectrum) was a pain to get into. I had to get brutal and the externals of the device suffered for it.

    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT£1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    Of greatest interest to me is the Silicon Labs MGM210L02ZJIP2 (?), Model: MGM210L22F module.

    Code: Text
    Log in, to see the code


    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    https://www.silabs.com/documents/public/data-sheets/mgm210l-datasheet.pdf

    1mb flash memory.

    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT
    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    There did not appear to be any debug log from TX or RX.

    Using Simplicity Commander (as seen in use here and here) and with my J-Link clone connected to PA01/PA02, Simplicity Commander complained my J-Link was not compatible with the architecture of the EFR32MG21 (ARM Cortex-M33).

    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    With a Raspberry Pi 4, OpenOCD can bit-bang SWD over the Pi’s GPIO pins, so it can be used as a basic debug probe for the MGM210L/EFR32 module. So I:

    -burned micro-SD card with headless Pi OS Lite 64bit (enabled ssh, set wifi creds, username/pw etc)

    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    -SSH to Pi after inserting SD card and boot has finished
    -update and install OpenOCD
    Code: Bash
    Log in, to see the code

    -create SWD config file
    Code: Bash
    Log in, to see the code

    -put this in config file
    Code: Tcl
    Log in, to see the code


    Connect module to Pi4 as follows
    Code: Text
    Log in, to see the code

    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    -check Cortex-M33 is talking with this test
    Code: Bash
    Log in, to see the code


    success:
    Code: Text
    Log in, to see the code


    -read 1mb flash to file
    Code: Bash
    Log in, to see the code


    -read userdata page to file
    Code: Bash
    Log in, to see the code


    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    -SCP in to device to retrieve dumps
    FTP client window listing files in /home/divadiow: two .bin files and rpi4-swd.cfg

    So now I have the device firmware where strings like these are clearly visible
    Screenshot of a hex editor showing binary data and readable strings including “IKEA” and “www.ikea.com”.
    and in userdata file
    Screenshot of a hex editor showing offsets, many FF bytes, and a highlighted ASCII string in the decoded text column

    I have not paired the original firmware with anything yet.

    keywords/markings:
    BP2036
    BP5936
    1942A01IW4
    V2.0-A-L-A-B90-02

    Added after 24 [minutes]:

    my dumps https://github.com/divadiow/FlashDumps/tree/main/IoT/EFR32/EFR32MG21
  • #10 21899809
    divadiow
    Level 38  
    Posts: 4904
    Help: 429
    Rate: 871
    1 find today in amongst all these bulbs
    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    A Teckin SB50 - ESP8266EX 1mb RGBW E27 bulb
    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT Green PCB with SMD components and wires on a blue work mat Close-up of a green PCB with solder joints and the marking “FL‑P27‑V2.3 2019.8.8” Circuit board with ESP8266EX module and power-supply components on a blue work mat Disassembled light bulb with E27 screw base, metal plate with connector, and part of a PCB on a blue work mat

    Couldn't get clamp method right to read flash chip, so unsoldered chip for breakout board
    Screenshot of NeoProgrammer showing a hex memory dump and repeated “IC not responding” messages in the log.

    decrypted KV
    Code: JSON
    Log in, to see the code


    boot log
    Code: Text
    Log in, to see the code


    dump plus mac-patched version https://github.com/divadiow/FlashDumps/tree/main/IoT/ESP8266
    mac-patched because some Tuya ESP8266 firmware will fail signature on pairing if the mac address is different to original device. Patched dumps will always pair with mac seen in original dump, regardless of mac of device pairing from (eg NodeMCU).

    IO4 - Red
    IO12 - Green
    IO14 - Blue
    IO5 - CW
    IO13 - WW

    It's running OpenESP8266 right now but it doesn't seem to like something with all the PWMs configured. It'll reboot into safe mode, flashing red LED several times as it does. Exit safe mode and it'll do that again and back into safe mode. I'll try to replicate on NodeMCU





    Added after 42 [minutes]:

    on reboot after saving same config on NodeMCU
    Code: Text
    Log in, to see the code
  • #11 21899927
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14459
    Help: 650
    Rate: 12468
    I didn't know there are EFR32MG21-based Zigbee chips! That's a very interesting read. I did some EFR32 experiments in the past, or... I think it was EFM32ZG222F32 .
    -> https://www.elektroda.pl/rtvforum/topic3861433.html

    Regarding crash - can you narrow down which pin PWM is crashing? There are currently 5 pins in settings.
    Helpful post? Buy me a coffee.
  • #12 21899937
    divadiow
    Level 38  
    Posts: 4904
    Help: 429
    Rate: 871
    p.kaczmarek2 wrote:
    Regarding crash - can you narrow down which pin PWM is crashing? There are currently 5 pins in settings.

    I think it's because they're initialised one by one and not in a group at once

    testing
    https://github.com/openshwprojects/OpenBK7231...e3af3756ac03e60a57480fd07d81efeab410c3d2eR453

    Added after 39 [minutes]:

    OK that works, but it flashes very quickly on boot, I think because it's still doing:

    Code: Text
    Log in, to see the code


    this next commit apparently:

    Code: Text
    Log in, to see the code


    https://github.com/openshwprojects/OpenBK7231...mmit/20e765d33c6eb0149ad409c6194a19424ceee3e8

    Added after 8 [hours] 36 [minutes]:

    seems OK now. no LED-burst on boot, no burst of all LEDs when changing colours, colour picker in web gui and web app tools works without invoking other channels as it's used. dimmer, temperature works.

    Before:
    - ESP8266 LEDC compatibility layer was initialised/reinitialised per PWM pin.
    - Reboot with 5 PWM pins configured would crash with IllegalInstruction after first PWM setup.

    After:
    - ESP8266 PWM pins are queued during pin setup.
    - Native ESP8266 grouped PWM is initialised once after all pin roles are configured.
    - 5-channel PWM setup boots successfully.

    The changes in summary:
    The fix changes the ESP8266 HAL path. ESP32 and the other OpenBeken platforms are left alone. On OpenESP8266, PWM pins are now queued as OpenBeken processes the pin roles, then the native ESP8266 PWM driver is initialised once with the complete channel group. Duty updates then use the grouped PWM channels rather than repeatedly rebuilding the backend.

    OpenESP8266 PWM is now treated as a grouped software-PWM peripheral, not as per-pin ESP32-type LEDC.

    HA colour stuff is correct and works
    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    £1 Re-Use smart bulb finds: IKEA Tradfri LED2003G1, Ener-J SHA5262, unbranded PIR, Yichip YC1166 BT

    boot log showing PWM init shape:

    Code: Text
    Log in, to see the code
  • #13 21900084
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14459
    Help: 650
    Rate: 12468
    To be sure, I can still change PWM roles at runtime? Is there live-rebuild?
    Helpful post? Buy me a coffee.
  • #14 21900088
    divadiow
    Level 38  
    Posts: 4904
    Help: 429
    Rate: 871
    p.kaczmarek2 wrote:
    I can still change PWM roles at runtime? Is there live-rebuild?


    yes and yes. let me prove/demonstrate in a couple of hours

    Added after 5 [hours] 34 [minutes]:

    divadiow wrote:
    yes and yes


    hmm not quite. changing PWM assignments will flash LEDs on save. Changes are effective but the flashing is what boot behaviour was like earlier. will try to fix
  • #15 21900319
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14459
    Help: 650
    Rate: 12468
    If it's just single LED flash on config save, then there is no issue, I guess? No one changes the device config during normal runtime/usage
    Helpful post? Buy me a coffee.
  • #16 21900332
    divadiow
    Level 38  
    Posts: 4904
    Help: 429
    Rate: 871
    depends how many PWM changes are being saved at once. it's also different for template import, which sets each individually. I think it's fine, and to be honest, maybe not many people will be looking to convert their ESP8266 bulbs at this point, in 2026, anyway. Who knows.

    Went further anyway https://github.com/openshwprojects/OpenBK7231....divadiow:OpenBK7231T_App:refs/heads/8266_pwm

    will test in an hour
  • #17 21900681
    divadiow
    Level 38  
    Posts: 4904
    Help: 429
    Rate: 871
    yeh, not going to pursue that further. it's already better now. It'll just have flashing LEDs on initial config if there are multiple PWMs being set.

    new branch, back to main fixes so multi-PWM works. also added "Always apply ESP8266 PWM duty updates" because it would get itself into knots switching between colours, leaving blue on for example when trying 100% red.

    https://github.com/openshwprojects/OpenBK7231...mmit/dddbccd60c739fdf19dd626d065927054d40d825

    Added after 51 [minutes]:

    p.kaczmarek2 wrote:
    I didn't know there are EFR32MG21-based Zigbee chips! That's a very interesting read. I did some EFR32 experiments in the past, or... I think it was EFM32ZG222F32 .


    that's a cool universal breakout board.

    EFM32 = non-radio microcontroller family.

    interesting
  • #18 21900829
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14459
    Help: 650
    Rate: 12468
    Can we merge ESP8266 PWM fix?

    EFR, with R, probably stands for Radio?
    Helpful post? Buy me a coffee.
  • #20 21904915
    divadiow
    Level 38  
    Posts: 4904
    Help: 429
    Rate: 871
    >>21897048

    no break-throughs with the ICE protocol, but pulling apart the Zengge app XAPK reveals 4 OTA firmware blobs for Yichip bluetooth devices

    Code: Text
    Log in, to see the code


    53_0035_08_01 being 1 build below the version in my bulb - 53_0035_09_01

    evidences
    | 53_0035_08_01.hex | 
    ..\..\..\sdk\yzw_sdk\Librarier\drivers\uart\yc11xx_uart.c
    , 
    AK001-ZJ2158
    , 
    SM2135EH
    , 
    LEDnetWF...
    , 
    ZJ_BLE_ADAPTER_VER
    , 
    ZJ_BLE_OS_VER
    , 
    PPlus_SUCCESS
    |
    | 53_0033_20_00.hex | 
    ..\..\..\sdk\yzw_sdk\Librarier\drivers\uart\yc11xx_uart.c
    , 
    ..\..\..\sdk\yzw_sdk\Librarier\drivers\pwm\yc11xx_pwm.c
    , 
    AK001-ZJ2158
    , 
    LEDnetWF...
    , 
    PPlus_SUCCESS
    |
    | 5A_0052_2A_00.hex | 
    ..\..\..\sdk\yzw_sdk\Librarier\drivers\uart\yc11xx_uart.c
    , 
    ..\..\..\sdk\yzw_sdk\Librarier\drivers\pwm\yc11xx_pwm.c
    , 
    AK001-ZJ2158
    , 
    LEDnetWF...
    , 
    enc ota
    , 
    PPlus_SUCCESS
    |
    | 56_00AD_41_00.hex | 
    AK001-ZJ21511
    , 
    IOTBT
    Attachments:
    • Zengge_Yichip_bluetooth_ota_blobs.zip (202.56 KB) You must be logged in to download this attachment.
  • #21 21905479
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14459
    Help: 650
    Rate: 12468
    Regarding ESP PWM, I wonder, if we need HAL_PIN_PWM_Finalize call? Couldn't we hide whole PWM fix under the HAL?
    Helpful post? Buy me a coffee.
  • #22 21905670
    divadiow
    Level 38  
    Posts: 4904
    Help: 429
    Rate: 871
    p.kaczmarek2 wrote:
    Regarding ESP PWM, I wonder, if we need HAL_PIN_PWM_Finalize call? Couldn't we hide whole PWM fix under the HAL?


    OK. 
    finalise
    hook has been removed and the ESP8266 grouped PWM startup is now fully contained in the HAL

    Added after 5 [hours] 4 [minutes]:

    there was a regression. I'll fix tomorrow
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ A discussion about bargain smart-bulb finds from a re-use centre selling mixed light bulbs at £1 for 4. The discovered bulbs included an IKEA Tradfri E27 LED2003G1, an Ener-J Smart WiFi A60 SHA5262 9W, an unmarked E27/A60 bulb with a PIR dome, and an unbranded 10W RGBW bulb. The follow-up inspection identified the second bulb as a basic PIR LED bulb rather than a smart bulb, with internal markings indicating a passive infrared motion-detection controller and related ICs.
Generated by the language model.
Today's popular

FAQ

TL;DR: At £1 for 4 bulbs, "there's potential" to find hackable smart lighting in a Re-Use bin. This FAQ helps buyers and tinkerers separate real smart bulbs from lookalikes, identify YC1166, WB3L/BK7231T, and PIR-only designs, and spot pairing or previous-owner lock-in issues before spending time on a teardown. [#21897048]

Why it matters: Cheap second-hand bulbs can hide reusable Tuya or Bluetooth hardware, but the same bin can also contain non-smart PIR lamps and already-paired devices.

Bulb What it turned out to be Main silicon or clue Practical result
IKEA Tradfri LED2003G1 Not yet covered in the shown teardown Workbench teardown pending Unknown from this thread
Ener-J SHA5262 9W Tuya smart RGB CCT bulb WB3L, BK7231T, PWM pins mapped Good candidate for template-based reuse
Unmarked E27 with dome Basic PIR LED bulb MX8198H + 1A21-Z PIR sensor Not a smart bulb
Unbranded RGBWW BLE+2.4G Zengge smart bulb YiChip YC1166 + SM2135EH Pairs inconsistently and stops responding after power cycles

Key insight: The best low-cost finds are the bulbs with identifiable radio modules or debug output. A visible PIR dome usually signals a motion bulb, not a hackable Wi‑Fi smart lamp.

Quick Facts

  • The haul cost £1 for 4 bulbs, or £0.25 each, from a Re-Use centre bulb drawer. [#21897048]
  • The unbranded RGBWW bulb uses a YiChip YC1166 radio SoC and an SM2135EH 5-channel constant-current LED driver on a module marked BY4-M5 V1.1. [#21897048]
  • The YC1166 debug console appeared on IO31 at 921600 baud and reported firmware 53_0035_09_01 with build time 20211116. [#21897048]
  • The Ener-J SHA5262 maps PWM channels to P8 red, P24 green, P26 blue, P7 cool, and P6 warm at 1000 Hz. [#21897152]
  • The PIR bulb identifies a 1A21-Z analog pyroelectric sensor with 135° horizontal and 123° vertical field of view, plus 2–15 V operation and 12 µA typical current. [#21897152]

How do you identify worthwhile smart bulbs in a Re-Use shop bulb bin before buying them?

Check for brand labels, smart-light wording, radio clues, and unusual domes before buying. In this haul, plain visual sorting separated four interesting candidates from ordinary fluorescent or incandescent bulbs, but one "interesting" dome lamp still proved to be only a PIR bulb. Prioritize bulbs marked IKEA, Tuya-style brands, RGBWW, BLE, Wi‑Fi, or with model numbers you can later trace on the PCB. [#21897048]

What hardware is inside the unbranded RGBWW BLE+2.4G bulb built around the YiChip YC1166 and SM2135EH?

It contains a Zengge module marked BY4-M5 V1.1 with a YiChip YC1166 MCU and an SM2135EH LED driver on the LED board. Other board markings include ZJ-PWH-RGBWW-L2 V1.1, CH-323L-009A, and ZJ-LB-BWPWH-RGBWW-L1. That combination points to a Bluetooth plus proprietary 2.4 GHz RGBWW smart bulb rather than a Tuya Wi‑Fi design. [#21897048]

How do you put the Zengge YC1166 Bluetooth bulb into pairing mode, and why is the process so hit-and-miss?

Use rapid power toggling, but expect unreliable entry into pairing mode. The thread describes this exact sequence:
  1. Turn the bulb on and off rapidly.
  2. Repeat the on-off cycle several times.
  3. Scan immediately with a compatible app.
The bulb only seemed to enter pairing mode after repeated on-off-on-off-on-off action, and even then discovery was "pretty hit-and-miss." That failure pattern suggests unstable pairing logic or strict app compatibility. [#21897048]

Why does the unbranded Zengge YC1166 bulb stop responding after a couple of power cycles?

The thread shows the bulb becomes unstable after a few power cycles, but it does not prove a single root cause. It would pair only inconsistently, then "stop responding after a couple of on/offs," even when the correct Zengge-branded app detected it. The strongest evidence is operational, not diagnostic: flaky pairing, strict app dependence, and repeated loss of response after mains toggling. [#21897048]

Which apps actually work with the YC1166-based Zengge bulb, and how does the Zengge app compare with other Zengge-made apps?

Only the app named Zengge worked in this test, and even that result was unstable. The author states that, among Zengge-made apps tried, only the "Zengge" app picked the bulb up, while other related apps did not. Even with that app, the bulb stopped responding after a couple of power cycles, so compatibility was narrow and reliability remained poor. [#21897048]

What is the YiChip YC1166, and what are its Bluetooth, CPU, memory, and flash capabilities?

"YiChip YC1166 is a Bluetooth microcontroller that drives connected lighting, combining a dual-core design with integrated 2.4 GHz radio support." In this bulb, it is described with Bluetooth 5.0 BR/EDR/BLE, proprietary 2.4 GHz support, an ARM Cortex‑M0 up to 48 MHz, 16 KB Data RAM, 16 KB cache/code RAM, and 4 Mbit / 512 KB internal flash. The quoted RF figures include about -95 dBm BLE sensitivity and up to +9 dBm TX power. [#21897048]

What is the SM2135EH LED driver, and what role does it play in RGBWW smart bulbs?

"SM2135EH is a 5-channel intelligent dimming LED constant-current driver that controls low-power LED channels, including RGB and white outputs." In this bulb, it sits on the LED disc and handles the RGBWW emitters, while the YC1166 handles radio, logic, and effects. The rear DAT/CLK pads lead to the SM2135H family driver, not to the YC1166 programming interface. [#21897048]

How is the YC1166 programmed through the ICE or IO31 pin, and what does the 921600 baud debug log reveal about the firmware?

The thread indicates the YC1166 uses a proprietary single-wire method on ICE/IO31, not the nearby DAT/CLK pads. IO31 also exposed a live UART-style debug log at 921600 baud. That log reported PPlus_SUCCESS, firmware version 53_0035_09_01, build time 20211116, ZJ_BLE_ADAPTER_VER 2.0.1_build0, LIGHT_VERSION 0.0.3_build0, and LED-driver initialization lines tied to SM2135EH. [#21897048]

In what way could an OBK BT ESP gateway or btproxy be used to detect or interact with a YC1166 Bluetooth bulb?

The thread suggests OBK BT ESP gateway or btproxy as a possible discovery path, but no actual test result is given yet. One participant asked whether an OBK BT ESP gateway could see the YC1166 bulb, and the reply said that btproxy should be explored because its setup and limits were still unclear. So the practical takeaway is simple: detection is plausible, but unverified in this discussion. [#21897922]

What did the teardown of the unmarked E27 bulb with a PIR dome reveal, and which PIR parts were identified inside it?

It revealed a basic PIR LED bulb, not a networked smart bulb. The teardown identified board markings PIRCVDY-8P-V5, PIRCVDB-8P-V2, and 2PH110122A, plus an MX8198H control IC and a 1A21-Z analog pyroelectric PIR sensor. That parts list matches a motion-activated lamp architecture rather than Bluetooth, Zigbee, or Wi‑Fi smart lighting. [#21897152]

What is the 1A21-Z pyroelectric PIR sensor, and what do its field-of-view and electrical specs mean in practice?

"1A21-Z is an analog pyroelectric PIR sensor that detects motion by sensing infrared changes, using a TO-5 metal-can package and very low current draw." The thread lists 135° horizontal and 123° vertical field of view, 2–15 V operating voltage, 12 µA typical current, and 28 µVpp typical noise. In practice, those numbers fit a wide-angle, low-power motion lamp front end. [#21897152]

How do you extract UART logs, Tuya KV data, and pin mappings from an Ener-J SHA5262 bulb with a WB3L/BK7231T module?

Use the module UART, then read the Tuya storage and configuration fields from the dump. In this bulb, TX2 exposed a boot log showing BK7231S_1.0.5, Tuya SDK details, product key keytg5kq8gvkv9dh, and schema 00000149dc. The same dump also revealed the Tuya KV block, SSID data, module name WB3L, and PWM pin mapping for all five LED channels. [#21897152]

What OpenBeken template and PWM pin configuration fit the Ener-J SHA5262 9W RGB CCT bulb?

The matching template is an Ener-J SHA5262 profile for BK7231T on a WB3L board with five PWM outputs. The thread’s OBK template maps P8 = PWM1 red, P24 = PWM2 green, P26 = PWM3 blue, P7 = PWM4 cool, and P6 = PWM5 warm, and sets the command powersave 1. The stored Tuya parameters also show 1000 Hz PWM frequency. [#21897152]

How do WB3L, BK7231T, and BK7231S_2M relate to each other in Tuya smart bulbs, and why do those identifiers sometimes differ in dumps?

In this bulb, WB3L is the module name, BK7231T is the chip family identified by the teardown, and BK7231S_2M appears as an internal platform string in Tuya data. The thread explicitly notes this mismatch: "Device seems to be using WB3L module, which is using BK7231T," while the dump still reports BK7231S_2M under em_sys_env. So one dump can contain module, silicon, and platform identifiers that do not match perfectly. [#21897152]

What other smart devices might turn up in Re-Use centres like this besides smart bulbs, and how do you safely evaluate them before purchase?

This thread only confirms bulbs, not other smart devices. The safe evaluation method shown here is practical: inspect labels and model numbers first, check for obvious clues like a PIR dome, then verify whether the device exposes a known module, debug UART, or prior pairing data after purchase. One Ener-J bulb still held the previous owner’s Wi‑Fi details, so second-hand smart gear can arrive already paired or provisioned. [#21897922]
Generated by the language model.
ADVERTISEMENT