Just got this today
https://www.itead.cc/sonoff-d1-smart-dimmer-switch.html
Its small
need to find the GPI0
or has some beat be 2 it
1 Like
…bet we could find it with a good pic of that uC PCB flipped over on the other side.
Although… that zero_cross pin seems a bit spooky… be awesome if it does zero cross switching, but if that’s handled by the uC then hacking will be steeply uphill.
Thanks! Here’s my best guess, without having better focused images or the board on hand:
Also, kinda hard for me to tell without better pics, if those pins labeled tx/rx are for the esp, or the other uC. I can’t read the markings on that side uC. We need better focus really.
OMG bro
Im still just looking at it
Thanks
It going to be the Dimming and the ON/OFF which is going to be the HARD bit
Yeah this is looking like the shelly dimmer with a separate uC that controls the FET. So it’s probably going to involve sniffing the (likely UART) lines between the 2 uC’s and RE’ing the signals. This isn’t by any means going to be a weekend project… unless of course itead is forthcoming with info.
Interesting, an SPDT labeled OTA…? The folks working on the shelly dimmer seemed to think that it may have the ability to flash both uC’s OTA… wonder if that switch allows that here?
Got mine in the mail an hour ago!
Here are some photos with a bit better focus.
There are test points for GPIO 0,2,4,5,RX and TX with the respective labels. (GPIO0 is marked “0”)
Attached to the heatsink is a TRIAC “JST12A 600SW 911 261” (https://datasheetspdf.com/parts/JST12A.pdf?id=1256360)
Hiding under the heatsink is a optoisolated triac driver MOC3051 (http://www.farnell.com/datasheets/301912.pdf)
Next to that is the zero cross detector TLP620: http://toshiba.semicon-storage.com/info/docget.jsp?did=16776&prodName=TLP620-4
There is also a fuse MST 3.15A 250V (http://www.farnell.com/datasheets/2861454.pdf),
a buzzer and some components to generate 3.3V DC:
ABS8 Bridge Rectifier http://www.farnell.com/datasheets/1885395.pdf
LP3669 (controller IC for the tranformer)
On the DC part of the AC PCB there is also a IC “6211a 1933” that I can’t find any info on.
On the pure DC PCB there are two unknown ICs named “bb10 f8g a016cx” and “590R 1933”.
There is also the ESP (ESP8285) and a “ES7P001FGSA CS278FN354” (apparently a 8 bit MCU, probably handles the 433MHz stuff?)
I wonder why they didn’t add a screw terminal to allow for use of the existing rocker wall switch to operate the dimmer… shouldn’t be to hard to add though
3 Likes
The BB10 F8G is the same chip in the Sonoff RF relay. Apparently there is a project to write new firmware to it so it can read all types of codes and not just the ones that Sonoff uses.
Yes I wanted the additional screw terminal too. Oh well.
I believe it’s an 8285 chip on board
Have you had a chance to look at it yet? I am fairly certain that the esp8285 chip talks to the EFM8BB10 over UART to provide the dimming. The Rx and Tx on J4 are for the esp chip and are connected to the EFM through the 1k resistor and the Tx/Rx pad to the pins 3,4 ? (bottom row in your pic first two from left) on the efm chip. When I messing around with it I noticed that if they were shorted to ground dimming functions stopped but wifi and the app worked normally. It may be that it uses a setup similar to the Tuya dimmers where the esp chip just tells the other one which dimming level to go to.
Also I am bit disappointed that the dimmer produces a slight hum or buzz in some dimmable Ikea LED bulbs. The same bulbs with the old dimmer didn’t produce and buzz.
I have not looked into writing a custom component for esphome, I don’t really have the time right now so I was hoping someone else would beat me to it 
Me too but I was hoping to understand how it works. Do you know how to monitor these serial lines to see what is being transmitted back and forth across them?
Sure, just hook up a usb to serial converter to them or a logic analyzer.
I tried that but got nothing up. Maybe I had the wrong baud rate
I’m seeing the same thing… I agree those pads very much look like the way to sniff the UART to the dimmer uC.
@robbz23,
Could be baud or reversed silk screen markings. Also, of course the bus may not do anything unless the dimmer is being moved around. I even read that with the shelly dimmer (similar 2 uC setup) hackers were thinking the uart may be used for OTA on that second chip; if that’s the case here you may not see anything happen on those UART pads (though I am leaning toward them being used to communicate dimming values).
Please be careful probing around with mains AC nearby! Also, even if you have the wrong baud rate you would see something… jibberish, but something there I’m pretty sure… but I don’t have your LA so not certain (I use a 300mhz 4ch DSO for household stuff).
On another note, J1 looks to me like an i2c interface for the EMF8BB10 (Data and CLock for “C2”), don’t you think? The traces look like they run straight to those pads to me. [edit: I just verified this with the datasheet. Yes, those are the debug i2c ports for the busy bee uC.]
It also appears that the ESP UART0 (TX0 and RX0) connects to the EMF8 UART, and both sets of labeled TX/RX pads (the pin holes and the test pads). This would be easy to verify with a meter.
UART1 also looks to be in use, with test pad marked “5” goes to RX1 and (it looks like) “2” goes to TX1. I can’t tell from the pics alone where they go from there, but I figure they wouldn’t be broken out if they weren’t important.
I unfortunately don’t have a la and was just hooking up a usb to serial adapter to the Tx and Rx on J04. I was able to get some random characters sometimes but nothing consistent. But come to think of it the other night when I was playing with it I used only the 433 remote to change light levels. That probably will not show up over the UART between ESP and EMF. Yes ESP TX0 and RX0 are connected to the EMF on those 2 lower pins. I believe they are 17 and 18.
I think they are using the EMF chip to control light levels and UART is being used to talk between the chips because when I ground J04 Rx and Tx and attempted to control it with the app nothing happened.
I think the test pads with numbers like 5,7,0 etc are just to break out different GPIO’s. They dont appear to connected to anything.
Do you think that anything interesting would be coming over i2c? Or is it just for programming the EMF?
My guess is the i2c is just for programming, as it doesn’t appear to be connected anywhere but the pads from what I can see.
Yeah for the uart you would have to get the baud right for it to make sense. I’m not 100% sure how the 433 remote part is integrated, but it would seem more difficult if that was also talking to the busy bee chip through the same UART as the esp. Seems more likely the esp would read the remote signal and send the dim signal to the bb, but this is just speculation.