Cheap UK WiFi Bulbs with Tasmota - teardown help (TYWE3S)

@TomHodson Nice one! I guess the SM16726 is the great unknown at the moment. I haven’t had much time lately but good to hear that you’ve had success with that. Glueing a header on is a great idea.

Hello guys! I recently got my hands on some of these bulbs. I can confirm that the white LEDs are running on simple pwm. Can someone please share the schematic for uploading the sketch on to the esp module? I am attaching two photos I took while measuring the current at full white(210mA,23V) and at full rgb white(170-190mA,23V).

This is cold white at full

I am running the bulb off a 24V smps for safety. It gets really hot in normal operation on mains. (70-85C, ambient 24-28C). The capacitors inside are rated for 105C… Not a very robust design IMO.

Hi! The white LEDs are arranged in series of pairs. By that I mean two LEDs in parallel. 7 pairs in series. Forward drop of each of the pairs are in range of 3-3.4V. When I am measuring the CLK and DAT lines on the DSO, I am reading 5V pulses. DAT is active low I think. These are directly connected to the module. So is this a 5V capable esp module?? Or am I measuring something very wrong?

I just bricked my bulb… :frowning: Did anyone have any luck with the led controller? The FastLed library has compatibility with the sm16716 not the sm16726…

How did you manage to brick your bulb? :open_mouth: @hatri

I managed to reverse the OTA mechanism on a bulb running the same firmware but with a MY9291 LED driver and tried flashing ESPurna OTA but it bricked the device. Ended up having to solder to flash it directly and now I can’t figure out how to load the stock firmware back on to try OTA again.

I managed to get the LED controller talking, I’ve got a pull request to Espurna in the works. It’s SPI on the clock and data pins, send more than 50 0 bits to start a frame, then a 1 and then 24 bits of RGB.


I tried to dump the stock firmware before I reflashed it. Here’s a link to what I got:

I don’t know if that’s enough to restore the stock firmware though, I don’t really understand the ESP’s memory layout, there may be other parts that I didn’t dump.

Fed 24V to the tx line most probably. The pcb is not very hacker friendly! :stuck_out_tongue:
The pinout is identical to the esp12F module. I will try replacing the tywe3s with a spare esp. can anyone confirm that this runs on 3.3V? I measured and got 5V data lines…

Thanks!! Do you have a translated copy of this datasheet?

When I flashed it I powered it off 3.3v and it worked fine but It may be that module is powered by 5V when you plug it into the mains.

Here’s a folder with the stock firmware image, datasheet and translation:

The translation only has the text so you have to compare the images from the original to the text from the translation. :b It seems to be that SET = 1 in this bulb.

Cheers I think I’ll buy another bulb though to give it a go. I did download the stock firmware from the Tuya servers before I attempted flashing it OTA and tried restoring it with ESPTool but there was no serial output once I flashed the stock firmware. Maybe it would have worked if I had disconnected the serial connections and attempted powering it from the mains? I didn’t try that as my soldering skills are limited and didn’t want to bother resoldering when I want custom firmware anyway.

I’ll be getting more bulbs soon so I’ll give it a go then. This isn’t the bulb I put in the OP, but it uses the same firmware from Tuya (or similar) so hopefully the OTA will be similar.

Here is a link to the bulb:

Far better brightness than the OP bulb for both white and RGB, plus the white is a warm white and can be made a cool white by combining the white channel and blue and green channels. The brightness output is exactly the same as a standard 60w equivalent LED bulb I had previously.

I got mine from smart home max. I’m not really too keen on ordering from them again. As I received a damaged bulb from them. 15192162934122280834679505834322

These are not my modifications. Came like this, the bulb used to restart randomly.

Tuya only produces these modules. You can find the exact same module on bulbs as well as smart plugs. They all run different firmware. I think the OEM is “sunyesmart”. The vendor I got mine from, seems to be a reseller.

Hi! Any news on the espurna pull request? Thanks!

I have accidently got this lamp from ebay (was searching for Sonoff B1 - some lamps have Sonoff B1in their description but are not).
I disassembled and unsoldered the ESP board. It tells on the printed circuit board for the connection of the TYW3S:
top left down:

top right down:

soldering some wires onto the board, I was able to flash Tasmota 5.12 on it.
With Module type “18 Generic” I used GPIO 5 as PWM1 and with “SetOption15 1” I got a slider for dark and bright. So this works.
I was not able to get the color working. GPIO 4 clock and GPIO 14 should be used to address the SM16726 with RGB values.
Unfortunately I am not yet able to compile ESP8266 code, I just use images and flash those.

I removed the 2 capacitors, too, to have better access for soldering on the ESP module. Nevertheless, I killed some tracks and ripped of some lands.

This picture shows the flashing interface. Power comes through the USB-Serial interface! Do not connect to the mains!

I connect the LED-PCB to an arduino as programming this way is much easier for me.
15 … 20 VDC was used to drive the LEDs. I used 0,35mm isolated copper wire for the connections.

And yes, I was able to control RGB-LEDs and white LED. White was easy.

I am using the Arduino serial input tool to input hex values as RRGGBBCW and for some debug output, i.e. 12FFC005 (12 for R, FF for G, C0 for B, 05 for white)
Extracts from my program …
For the white:

int CWpin = 9; // the PWM pin is attached to D9
byte CW = 0; // brightness of the LEDs, initally zero

and for the RGB-LEDs using the SM16726 (same protocol as SM16716) …

#include “FastLED.h”
#define NUM_LEDS 1 // as 1 LED with 3 colors.
#define DATA_PIN 3
#define CLOCK_PIN 13

CRGB leds[NUM_LEDS]; // this is the array of leds used by FastLED

in the setup:
FastLED.addLeds<SM16716, DATA_PIN, CLOCK_PIN, RGB>(leds, NUM_LEDS); //SM16716 is said to be equiv. to SM16726

in the loop with R, G, B being declared as Byte:
leds[0] = CRGB(R,G,B); // prepare the data; // update the color LEDs

analogWrite(CWpin,CW); //update the cold white

So it is time to bring this into ESP using IO4 for clock, IO14 for data and IO5 for the cold white.

Thanks so much! Can you confirm if both the sm16716 and sm16726 use the same protocol??