Introduction. #
So i couldn’t help myself and also bought the Table lamp at Action. Another 8.95 Euro lighter and its on my desk. Lets try to hack it! I think it will be a lot easier as the other one as this probably has just 1 led channel instead of both analog and digital leds hooked up to 1 wifi module. I also wonder if this has the same new T1-U-HL module inside, so lets see.
Pictures of the product and box. #
So lets first look at some pictures. Below i posted some pictures of the Box, the outside looks and ofcourse the interesting insides.
Box. #
The product Unboxed. #
Powered on and Lit. #
Teardown. #
SO now lets take a look inside! So i thought that the electronics must live in the base/stem and the leds up in the top dome. So i removed 2 of the rubber standing pads on the bottom to reveal 2 more screws. In total i had to undo 4 screws.
Nothing to see here. #
And its open! Sadly there is not much if anything at all here :(. Just the wire. SO that means the electronics live in the top dome part. Good to know!
Trying the top part. #
I think i could just pry this open and yes you cna pry it as i think its held in with clips.
Aaaaand its open! Below some pictures of the device.
As Expected Our friend the T1-U-HL! #
And yep as expected! We see our friend the New Tuya T1-U-HL module once again :) Great that means it can definitely run OpenBeken and can be freed from its cloud prison. Its the same module we found in that floorlamp. Maybe these newer tuya products all use this module.
Back of the PCB. #
The back of the PCB has not much on it, other than the LED’s and the led driver IC. Seems its analog leds hooked up to the LED driver which probably talks over I2C (Inter-Integrated-Circuit comminucation). I believe OpenBeken has support for those. It is a Linear driver i think as it gets quite toasty and i dont see any inductor for it (The inductors i do see seem to be for the powersupply (buck converter) for the Wifi module/control electronics).
LED Driver. #
CloseUp of the LED driver chip shows its marked bp5758. I recognise that ‘bp’ suffix. In our case thats the sufix of the chip’s maker, aka Brighhtpower. They are a chinese manufacturer that specialise in all sorts of driver/control chips. They are quite common in these cheaper products and they also have non-smart led driver chips that are used in non-smart mains-powered led lamps and led setups. In our case its the smarter variant that allows I2C communication to be able to control specific channels. Searching the Product Info Page I see that it has 5 Individually controllable channels and is dedicated to smart lighting gear (Which fits the product ofcourse). 5 Channels making up the RED, GREEN, BLUE, WarmWhite, ColdWhite leds. It is indeed a linear driver and thus wastes excess power as heat. Its kind of like a fancy controllable resistor at this point and linear drivers are also quite inefficient but cheap as chips. It provides a constant current which LED’s require in order to operate correctly and last the longest. I wont go into the specifics of why and how as thats a topic for electrical engineering class and people to solve and i am not an electrical engineer.
Time to flash the custom firmware - Backing up Stock. #
First let ofcourse make a backup, so in case we ever need to, we can restore the product to when it came fresh out of the factory. First let find UART. Welp, there are no exposed UART pads unlike in the other lamp, so we have to solder directly to the Wifi module… Also i want to power it through the 3.3V and GND pads which are exposed on the PCB, as i dont want to have mains dangerous voltage running through it while I am flashing new firmware as any mistake can cause a nice big jolt and i ofcourse know about safety as i once touched the capacitor ina tv while it was plugged in and got quite a shock that my Arm was numb for a few hours…. Yeah not fun to experience that, so lets avoid that! Also avoids the risk that if you accidentally short the wrong thing, it can blow up or catch fire.
Searching for the Product Info Page about the T1-U-HL module shows that Pins 15 and 16 are TX and RX of the UART1 serialport used for flashing the firmware and interacting with the firmware on device. So i soldered some wires to it. I did burn a small part of my hand cause the soldering iron slipped out my hand, but oh well, it smells like chicken now lol!
And pulling pin CEN/RESET of the module (Pin 18) to GND briefly and the software can now dump the firmware! And wow this one does output a valid tuya json config with all pins pre-mapped for us and some other variables like led curent and remap.
{
"Jsonver":"1.0.0",
"brightmin":"10",
"gmwb":"75",
"title20":"1",
"gmwg":"70",
"wfcfg":"spcl_auto",
"colormin":"10",
"pmemory":"1",
"gmkb":"60",
"pairt":"18",
"cmod":"rgbcw",
"mixway":"0",
"cwtype":"0",
"rstbr":"50",
"remote_switch":"1",
"control_priority":"1",
"colormax":"100",
"iicw":"3",
"notdisturb":"0",
"module":"T1-U-HL",
"iicsda":"26",
"cwmaxp":"100",
"dmod":"6",
"iicc":"4",
"brightmax":"100",
"iicg":"1",
"wfct":"10",
"iicr":"2",
"defbright":"100",
"rstcor":"r",
"rstnum":"3",
"deftemp":"100",
"bleonoff":"1",
"dccur":"14",
"iicb":"0",
"iicscl":"6",
"wt":"20",
"onofftime":"800",
"prodagain":"0",
"remdmode":"3",
"cagt":"20",
"drgbcur":"12",
"colorpfun":"0",
"gmwr":"100",
"rgbt":"10",
"gmkg":"60",
"onoffmode":"0",
"dwcur":"14",
"category":"0505",
"gmkr":"80",
"defcolor":"c",
"crc":"42"
}Time to flash the custom firmware - Flashing OpenBeken. #
So now its the exact steps but instead of clicking the backup button, click the ‘write’ button to write the firmware on it. If no firmware image is preselected, you can click the dialog box to download firmware automatically. Then flash it.
Configuring it through the web portal. #
SO now its the same steps as the other lamp. Wait for it to emmit a wifi Portal and then connect to it and configure it through the web portal. COnfigure the Wifi and then connect to its WebUI again, easy as cake. But you can also preconfigure it in the openbeken software, its just what you prefer. I set it up and now we are ready to configure the led driver. One thing i did notice is that this table lamp seems to use RT_Thread as the RTOS layer instead of FreeRTOS as you can see the below output over UART1. Anyways, i put in my wifi credentials in the webportal and it showed up successfully and i managed to access its webui.
BK7238_1.0.15
REG:cpsr spsr r13 r14
SVC:0x000000D3 0x00402108 0x00015E80
IRQ:0x000000D2 0x00000010 0x00401930 0x00079FB2
FIR:0x000000D1 0x00000010 0x00400940 0x00015E80
SYS:0x000000DF 0x0041A540 0x0007C915
ST:0x00010001
[I/FAL] Fal(V0.4.0)success
[I/OTA] RT-Thread OTA package(V0.2.8-beken-1133282d-20220604) initialize success.
go os_addr(0x10000)..........Openbeken config. #
Because the firmware is now alive on the device, i will hook it up to mains power again so we could see if we can control and talk with the LED driver chip over i2c. And after setting P6 to BP5758_CLK and P26 to BP5758_DAT in Openbeken, it works! The light is shining. Now i did notice that it seems like RED and BLUE are reversed and green is working and warmwhite/coldwhite is working properly, so i must set the correct mode in the BP5758 led driver of openbeken. So instead of normal RGB, i set BGR by using the mapping command: BP5758D_Map 2 1 0 3 4. After that i also set the current of both the RGB and White channels apropiately, thats what this next command does. It sets the RGB channel current to 12 Milliamps and the CC (WHITE) channel to 14 Milliamps: BP5758D_Current 12 14. I could reference the Handy extracted tuya config for most setting up so this was a piece of cake and in like 5 minutes max i had a working table lamp! What a breath of relief after fighting the 2 seperate analog/digital channels of the previous floorlamp i took a look at! Easypeasy. It almost felt too suspicious how easy it was and how quickly i got light output working! Below i have the complete Openbeken config ready so you can plug in the config into openbeken and everything instantly works!
{
"vendor": "Tuya",
"bDetailed": "0",
"name": "Action LSC SMart Connect Decorative Table Lamp",
"model": "LSC-Table_Lamp-Obk",
"chip": "BK7238",
"board": "TODO",
"flags": "0",
"keywords": [
"TODO",
"TODO",
"TODO"
],
"pins": {
"6": "BP5758D_CLK;0",
"26": "BP5758D_DAT;0"
},
"command": "backlog startDriver BP5758D; BP5758D_Map 2 1 0 3 4; BP5758D_Current 12 14; SetFlag 10 1; SetFlag 17 1; SetFlag 18 1; SetFlag 23 1; ",
"image": "https://obrazki.elektroda.pl/YOUR_IMAGE.jpg",
"wiki": "https://www.elektroda.com/rtvforum/topic_YOUR_TOPIC.html"
}Also i had to manually set some flags as it seems to be some weird quirk with Openbeken’s flag argument parser that if i put some values there, it would enable all flags from 30 till 51.
After that just put in your mqtt credentials if you run homeassistant and then click on ‘homeassistant discovery’ and voila, it works!
Signing off. #
So this was an eays and quick project i could do. Always feels nice to explore a new product and to get custom cloud-free firmware working on it! It does get pretty toasty because of the leds, barely any cooling, a linear driver and such. If you operate it long enough, the top gets pretty toasty! Also i dont know how long it will last as it has 2 aluminum capacitors on the PCB (Smd caps) and i doubt capacitors like to be put in a hot torture chamber for long, so i dont know how long this cheap product will last, but its 9 euros anyways and i bet they ahd to save some costs, but if i was the designer, i would have extended the pcb to fit the whole dome as now its 80% Air and plastic. A bigger pcb will also mean more cooling/heat spread so you dont bake your wifi chip or capacitors.
Anyways thats it from me for now! Have a great day and bye.