Philips Hue – control anything hack

To be honest, my recent simple relay hack wasn’t really all that great. It just used the high power constant current output to drive a SSR. It wasn’t ideal, but it worked. I decided that it was worth the effort to track down some more useful outputs and properly detect the desired state of the bulb.

b22_closeupAll it took was a little bit of poking around and probing the pins of the SAM R21 microcontroller with an oscilloscope. It wasn’t actually that hard. On the B22 bayonet fitting version of the bulb I found some.

PA16 (pin 17 of the microcontroller) has a simple on/off output. It’s high (3.3V) if the light is on  at all and low if not. This is the perfect output to use to drive a simple output for a relay. It can be run straight to a SSR if that’s appropriate for your load. Or it can be used as an input to another microcontroller, a transistor to drive a relay, etc. This is probably the easiest one to use for a simple load. A slightly easier place to access it is on the end of diode D3 nearest the micro. It’s still some fiddly soldering, but it’s easier that a QFN pad on the SAM R21 itself.

PA17 (pin 18 of the microcontroller) has a decent PWM output. Unlike the one I found on TP5 of the E27 bulb, this stays high when the bulb is 100% on. It’s a 3.3V signal. It doesn’t seem to be quite linear – i.e. 50% brightness isn’t a 50% duty cycle but this may be deliberate to compensate for how bright it actually looks.

TP25 has a DC voltage of about 14V which is fed to the LM2204 3.3V regulator. This seemed handy for driving the coil of a 12V relay.

I rigged up a simple relay circuit – using the 3.3V PA16 output to drive a NPN transistor that can then drive the relay. Add the usual flyback diode (and a MOV across the relay contacts for the benefit of inductive loads) and all is g0od!

Poor post sales service from Zero Motorcycles

If you want the tldr version

I’m now a Zero owner, but not yet a Zero rider. I paid for a Zero FXS 8 weeks ago. Due to Zero’s errors, the process of registering it in my name hasn’t even started yet. In that time the price dropped £900. Zero won’t talk directly to me but have said via the dealer that it’s tough luck. They’ve got my money and don’t really care about either.

The full story…

After my test ride of a Zero FXS it was only a matter of time before I got one. The things up in the air back then were:

  1. What’s going to happen with the long-promised UK electric motorcycle grant?
  2. What have Zero up their sleeves for 2017?

In October the grant was announced as starting from 1st Jan 2017. And in November Zero announced that there were a few changes to the 2017 line up, but nothing huge. For the FXS it was really just a wider drive belt and a higher amperage controller. No battery or motor changes.

This was enough for me to order and pay for a FXS on 17th December. Zero listed the 2017 as £9890 (after grant) and had a £1500 off offer on the remaining 2016 models. The 2017 models were going to be available for a few months but the 2016s were in stock. Let me see… £1500 cheaper and available immediately? Easy decision. I went for the 2016 FXS and paid my £8390. The dealer told me I’d have it by early to mid January just after the grant came into force. Perfect.

Balls-up #1

So. Early in January my shiny new bike arrived at the dealers. Yay! But the paperwork didn’t. What? How can a letter take longer than a huge crate? Zero hadn’t sent it, that’s why. Why not put it in the crate FFS? It eventually arrived a few days later.

Balls-up #2

Now, in the UK you need insurance to register a vehicle so I transferred the insurance over from the Aprilia Dorsoduro that I was trading in. Registration normally takes a week or so. I picked 21st January to allow 2 weeks to make sure the DVLA did their stuff. The dealer was happy to let me do this because – well why not? It was only after I’d done this that Zero revealed that well… they hadn’t actually sorted out eligibility for the UK grant at all. No way I’d get my FXS registered by the 21st. This left me uninsured on my Dorsoduro from that date.

My insurance company (Wicked Quotes) only wanted about £100 a year to insure either bike, but admin fees to change things were a different matter. As if the £50 to change it over wan’t bad enough, changing it back for a bit would cost at least £100 and they couldn’t guarantee that my premium on the final change wouldn’t increase. Considering they had quoted me £238 a year at an earlier date, I sense a trap. Anyway, it just wouldn’t be practical to change it. I was now insured on a Zero I couldn’t have and uninsured on an Aprilia that I did.

Oh well, bikeless for a week or two and riding uninsured on the swap-over trip to the dealers. I can live with that I suppose. Just need to make sure I avoid any cameras.

Balls-up #3

So on the 23rd January the grant was finally sorted. Registration underway! A week later I got a call. Registration rejected! What??? Apparently the “certificate of arrival” that is part of the import process had a US formatted date on it. Instead of saying 7th January (07/01/2017), it said 1st July (01/07/2017). The DVLA couldn’t handle this, and better yet, it was an official document that couldn’t be altered. It had to be redone. More delays. Now I don’t know exactly what this form is all about, but as Zero are the only Americans in the whole chain I have my suspicions as to who got it wrong.

Slap in the face #1

Just as this was happening I got a lovely promotional email from Zero. A 2017 FXS for the great price of… £8990. What? Only £600 more than I paid for the £1500-discounted 2016. Now we’ve all bought something that goes on sale later. That’s life. I wouldn’t complain about that. What really irks me is that this price drop is before the 2017s even available – they never were £9390. And it’s before I’ve even registered (due to Zero’s mistakes) my 2016.

I went for a 2016 because it was £1500 cheaper (not really) and available straight away (again no). I dropped Zero an email and copied in my dealer – the totally faultless 21st Moto in Swanley, Kent.

Slap in the face #2

Zero didn’t think it necessary to reply to me. After the dealer chased them Zero Europe said they’d see what they could sort out with Zero USA. After yet more chasing, I got a reply via the dealer.

  • Could I drop this 2016 (with a serious known issue I discovered described here) and take a 2017 instead? No.
  • Would they do anything about the price I paid or the problems they caused? No. Tough.

I was very close to seeing if I could cancel this whole thing, but decided this would be cutting off my nose to spite my face. I’d paid for it so probably couldn’t. And anyway, if anything the dealer would probably end up losing out.

I had also agreed to do some promotional stuff with the Motorcycle Industry Association to publicize the UK grant. I was after all the first person to make use of it. (Free publicity for Zero too!) It would seem unfair to let them down.

Something nice to say at last

Well, after all that ranting I can at least add some positive things to the mix. As I said, 21st Moto have been great throughout all this. Rob was dealing with all this and I know the problems weren’t anything to do with them. Even so, they felt bad about it all and have offered to drop £250 off the price out of their pocket. I kinda feel bad taking this as I have no problem with the dealer at all. As Rob said though, the buck does stop with them from a consumer’s point of view. They are they ones that have to deal with Zero.

Thanks, Rob and 21st Moto. Despite all the hassle I’ve had I can thoroughly recommend them. If the awesome silent power of an electric motor ever gets stale and I feel the need for a roar of a petrol engine, then I’d definitely be heading there with my cash for a Honda.

Hopefully only a few more weeks to go. (It’s now so close to the new 17 registration on 1st March I decided to go for that.) Once I’m on the bike I’m sure this will be a dim memory. And the weather’s not exactly been bike-friendly lately – below freezing with snow and ice.

Philips Hue – simple relay hack

img_20170102_162008OK, so I said I’d start simple but this is about as simple as it gets. I’m almost embarrassed it’s not a little more complicated. I’ve done a teardown of a LBW010 bayonet fitting bulb and thought I’d take a look at its E27 screw-in cousin. (I’ll post this teardown later, but here’s a photo to give you the gist of it.) You can see the main board in the centre and the LED board that I’ve removed. It was similar to the B22 but quite different too.

Coming in from the left in the main photo below are the Hue mains connections – blue neutral and red live. My apologies about the mixed colour schemes but those were the wires I had to hand. Heading out on the right are the positive (red) and negative (black) that normally run to the LED PCB. All I’ve done is connect these directly to the input of a solid state relay. That’s it.img_20170104_212708

So why is this hack a little blunt? Well the four wires you see that aren’t connected are my far more sophisticated attempt to dig out some useful logic signal from test point on the PCB. There’s some nice stuff there. I thought I’d use a PWM output I found on TP5 to drive the SSR. It was almost enough but I hit a small snag. (Currently it works as expected between 1 and 100% but irritatingly switched the SSR on when at 0%.) I thought about leading these to a logic circuit, maybe even another microcontroller.

Then I saw the 3-32V input on the SSR. 32V?? That’s a little bit more that the Hue puts out the the LEDs. Could I? Yes, I could. The Hue outputs are used to driving 260mA at about 31V so with minimal load it actually reached about 37V, but it seemed to work fine. I’m using a constant current driver to drive a low impedance and just getting lucky that the voltage limit is being hit. I know that’s not sensible.

So basically , rip the bulb apart, connect it to a SSR and you can now drive any mains lighting you like! It should work with the B22 and maybe even the GU10 bulbs too, but these single colour bulbs are the cheapest.

Things can certainly be done a little better and it will be. For instance:

  • I could use a voltage divider to tame that 37V a bit.
  • I could drive a normal relay if I added a  suitable series resistor and a flyback diode. SSR have problems driving some loads – ironically LED drivers being one of them.
  • I could dig further into that PWM signal and properly detect the power level of the light, maybe driving more than one relay or SSR.

Anyway, all this will come but I thought this simple hack was worth sharing as-is.

UPDATE: A better way to get to a decent signal to control anything (using a B22 bulb) here.

Philips Hue garden floodlight

So, after the initial teardown, it’s time to start the Philips Hue hacking. To be honest this is fairly simple so doesn’t really qualify as a hack. I said I’d start small and work up from there, so consider this a warm-up exercise.

I’ve got a motion sensing 10W LED floodlight mounted on my workshop. It’s supposed to light my way as I head out there but it doesn’t really work as I’d like. As I’m walking straight towards it the PIR only triggers when I’ve already trudged through the dark garden and I’m about a metre away. Also, the local foxes are constantly triggering it at night. Having this under Hue control would be ideal. Let’s take a look.

img_20161231_130126My Wicked brand floodlight contains a single chip LED which actually had 9 separate LEDs on the die. It has a constant current LED driver which outputs 350mA at about 24V. Hmmm – this could be very easy. They pretty much matches the Hue bulb I tore down. Electrically this might be as easy as connecting the spotlight’s LED in place of the Hue’s board. And you know what – it was! I did a quick check that the hue bulb circuitry was happy to dive the LED in the floodlight directly and then it was just a case of putting it all together. Out came the PIR sensor. Out came the constant current LED driver (the white box) and in went the Hue circuit board.

img_20170102_130311The only tricky bit was deciding where to put the PCB. Once the LED driver had gone, there was plenty of room behind the light. However, this was a metal case and the light is a fair distance away from the house. I didn’t think the Zigbee signal would reach. It didn’t have to be in the lamp at all of course, but it seemed neater.

I decided that the best place to put it was where the PIR has been. All it needed was a new 3D printed front cover. I could have saved space and printed a new back piece. I could have missed out the hinged bit and printed a two part case. My new Year’s resolution is to get project finished so I went with the simplest option.

img_20170102_131430So, here it is side by side with an original. Fitting was pretty easy. The only gotcha I has was that as i connected it, the Hue hub decided it would be a good time to update the firmware in the bulb. Hue bulbs normally switch on when first powered but whilst updating it was off. Cue some unnecessary checking of wiring, removing and remounting it, checking fuses, etc. Oh well, it working


Philips Hue LBW010 teardown

Why Hue?

I’ve been thinking about some how automation for a while but have been wondering how the best way to go about it would be. I was thinking of a mesh network of battery powered switches using Sub-1GHz 6LoWPAN – hence the recent mucking about with Contiki OS. However, I decided to go for a couple of Amazon Echo Dots in a recently Black Friday promo and decided that I should get an off-the-shelf solution working whilst I spend the next couple of years making the “perfect” one.

After a little research I decided on the Philips Hue system. These are Zigbee controlled bulbs that you leave permanently powered. The system isn’t perfect – but better than the others on the shortlist. Z-Wave is proprietary. LightwaveRF leeches power through the bulbs and you can’t tell if the device heard your command or not.

Philips did get some grief for locking out other Zigbee devices but seem to have reversed that. Obviously other devices don’t quite get the love that Philips products do, but they’re OK. On the plus side, Philips have documented a nice API at the hub level that allows you control their bulbs from the outside of the Zigbee network. They are however understandably protective of things on the inside.

On the negative side, Philips do not have a device that can control an arbitrary light. I’ve got a floodlight and some track lighting in the workshop. Can’t do those. My bathroom has about 9 GU10 bulbs in the ceiling – possible but 9 x £25 is an unpleasant £225.

What’s the plan?

My plan is threefold.

  • Firstly, I want to take one of the cheaper £15 single colour bulbs apart and see what’s what.
  • Secondly, I want to extend the Hue ecosystem but by “gently” hacking it – i.e. buying a Philips Hue product, leaving their hardware and code more or less intact but adding what I want to it.
  • Thirdly, I’d like to do some Zigbee work. Maybe make a slightly more feature rich switch that those they supply. Maybe vreate a Zigbee light that Philips are happy to work with

Anyway, I’ll start with the simplest so I have something working and take steps from there.

What’s inside then?

img_20161209_174552Before I start, let me say that I was greatly helped by the work of others such as Colin O’Flynn. I’m not the first to tear open a Hue bulb, but it turns out my UK spec bayonet fitting LBW010 is a bit different to those before.

First you have to remove the plastic top. I used a small hacksaw, but it eventually came away in one piece when the glue gave way. I think a little bit of squeezing in the vice might have been all that’s needed. It’s not like I’m going to put it back together anyway so not too important.

img_20161209_174841It opens up to reveal the LED board (with metal heatsink) which is attached with a couple of screws and more glue. I tried a heat gun to soften the glue but that didn’t help. In the end just some levering with a small screwdriver did the trick. The LED board separates nicely from the logic board and has a simple 0.1″ pitch SMT header for this. Very useful. Some quick measurements show the LEDs have a voltage of 24.4V and a current of 350mA. I assume there’s a constant current supply on the PCB but I’ve not taken the time to track that down yet.

One thing worth noting on the B22 bulbs is that the two main contacts for mains power are actually solder. Before pulling the PCB out you should melt the solder on these. I didn’t and ripped on of the 15Ω resistors that are used as fuses from the PCB. Easily replaced, but annoying that I was heavy handed with this.

hue-pcb-bottomOther bulb teardowns revealed an Atmel ATMega2564 (AVR microcontroller with Zigbee) and a ST HVLED815PF (LED driver) but my bulb seems to be different. Inside is an Atmel SAM21R21E18A – the same ARM microcontroller with Zigbee as found in the Bridge. I couldn’t find a LED driver IC so this is perhaps constructed using discrete components. I didn’t look very hard though. I will try to get a better photo later.

There are a number of test pads. Careful probing a track tracing shows they are as follows:

TP2 – PA30 on the microcontroller. This is SWCLK for debugging
TP3 – PA31. This is SWDIO for debugging
TP4 – Serial TX (more on this below)
TP5 – Serial RX
TP6 – main output to the LED
TP7 – 3.3V. This is the output from the 3.3V regulator and input to the microcontroller. It can be used to power the board but you’re better off using TP25.
TP8 – RESET for the microcontroller
TP11 – GND
TP25 – Power in to the LM2204 VLDO regulator. It takes about 24V when powered from the mains but is happy when powered with 5.1V from USB for hacking about.

What was most interesting initially was the output on TP4. It contains debug messages from the Atmel Zigbee stack and on power up you get something like this. Output is 115200 8N1 and line endings are CR only.

[Log,Info,S_LightConfiguration,Configuration Data OK, crc=0x60083D2F]
[Log,Info,S_DeviceInfo,Default Flux table]
[Log,Info,S_DeviceInfo,ProductId: Philips-LWB010-1-A19DLv3, ModelId: LWB010]
[Log,Info,S_DeviceInfo,ZLLDeviceId: 256(DimmableLight), PwmChnl: 1]
[Log,Info,S_DeviceInfo,Booting into normal mode...]
[Log,Info,S_DeviceInfo,DeviceId: ConfLight]
[Log,Info,ConfLightLamp,Platform 0.85.0: r19111, BC_V3.3.0_2.4_M: r19111]
[Log,Info,ConfLightLamp,Product version ConfLight fw_ver: 1.15.0_r18729,built by LouvreZLL]
[Log,Info,A_Commissioning,NwkAddr: 0x32BE, Ch: 20, Pan: 0x5DE4, NwkUpdId: 0, ExtPanID: 8D80F343023D3B9E]
[SYS,Info,Transmit buffer full]
[Log,Info,N_Connection,Starting discovery for updated networks]
[Log,Info,N_Connection,Discovery for updated networks completed]

This is interesting and my initial thoughts were that I could capture any output when light levels are set and make use of these. Unfortunately, there’s nothing interesting once the bulb is connected and running.

hue-pwmI decided that there must be some more useful output from the microcontroller going to the LED drive circuitry so decided to probe the pins whilst changing output. Bingo! It seems that we have a nice PWM output on PA17 with the duty cycle representing the brightness.You need to move a large electrolytic capacitor out of the way to get to the IC and it’s pin 18 (the second one up from the bottom on the RHS). I haven’t traced it to a test point or other more accessible location yet, but I will.

6LoWPAN part 2 – Building Contiki on Windows

Getting started

Following on from my previous post about wanting to experiment with 6LoWPAN and Contiki, I suppose I’d better do something. First things first. I needed to download Contiki and get it building. I’ve got a few options.

A Linux VM

The official guide pointed me towards using a pre-configured “Instant Contiki” Ubuntu VM and that certainly works. I needed to install and setup VMWare but that wasn’t too bad. It’s probably time I played around with Linux a bit more, so I also installed Linux Mint (easier for newbies) in a VM too.


There was also a guide on Sun May Sky about using Cygwin on Windows. I’m sure this works as described and I was about to give it a try, but then I though “Cygwin? Isn’t that a little outdated for Windows 10?”

Bash on Ubuntu on Windows

ubutntu-on-windows-10-logo-bannerThere is a “proper” Ubuntu bash shell as (a hidden) part of the latest Windows 10 build so that seemed like a neater solution. In theory, this should be closer to a normal Linux shell that Cygwin. Time to give it a try and write my own guide. Spoiler – it works!

Firstly, enable the hidden bash shell. The Microsoft guide is here so you may want to open that for the details. Basically all you need to do is:

  • enable Developer Mode (you’ve done that already, right?)
  • check the newly revealed “Windows Subsystem for Linux (beta)” windows component.
  • Use the Bash on Ubuntu on Windows app

The only thing worth mentioning is that your C drive will appear as /mnt/c rather than Cygwin’s /cygdrive/c.

YaKai Chen’s Cygwin guide mentioned installing the ARM GNU Compiler toolchain and adding the installation folder to the path. The default Windows installation path with spaces and (x86) is awkward to use in Linux and it turns out it isn’t even necessary.
I went to build a Contiki component with a make command. See one of the many guides for a specific build.

build-error-1-armYou’ll notice the make failed with arm-none-eabi-gcc not found, so I tried just entering arm-none-eabi-gcc. A very helpful prompt told me that apt-get install gcc-arm-none-eabi might solve my woes. And it did.

build-error-2-srecordTime to try that make again… OK, this time srec_cat was the missing culprit, but just typing srec_cat told me what needed to be installed. Simply apt-get install srecord and I was ready for attempt #3… and success.

build-error-3-successThat seemed easy! Don’t tell anyone, but I might get to like this new Bash shell. Now to get something meaningful working…

UPDATE: Compiling the hello-world example failed with cc not found, but apt-get install gcc sorted that one. There may be more, but I sense a pattern here.

6LowPAN (part 1) – discovering sub 1GHz mesh networking


So, party inspired by my not particularly successful Tado teardown I’ve decided to play around with 6LowPAN. “What’s 6LowPAN?” you may ask. Well, it IPv6 networking over Low power Wireless Personal Area Networks. That’s what Tado uses to communicate between its components and I thought I might re-purpose their gateway for this. Unfortunately it uses a slightly out of data Stellaris microcontroller and getting this working was awkward. I got bored with it.



The ultimate goal would be to have drop-in smart light switches that link up in a mesh and can be controlled remotely home-automation style. Ideally I’d like something that:

  • can report its status back (unlike some commercial offerings)
  • is battery powered so that there’s no need for a neutral connection in the switch
  • doesn’t leech power through the load – that’s cheating and won’t work well with LED lighting
  • can operate as a separate manual switch in case the network is down

How far will I get with this? Who knows. Let’s see.


6LoWPAN can sometimes be over a 2.4GHz network (like Zigbee) but I’m going to go with Sub-1GHz for better range through walls and hopefully as far as my garden office / workshop. TI do a nice range of Sub-1GHz ARm microcontrollers. I got myself some CC1310 launchpads and a CC1350 launchpad too for good measure.

As far as software goes, it looks like Contiki is a good place to start. It’s a RTOS designed exactly for 6LoWPAN. It looks pretty good, but despite the best efforts of the creators I must admit it doesn’t seem easy to get started with. There is some helpful stuff over at Sun May Sky which I believe is maintained by YiKai Chen who you’ll also find helping out over on the TI E2E Community.

Getting started

First things first. I needed to download Contiki and get it building. The official guide pointed me towards using a pre-configured “Instant Contiki” Ubuntu VM and that certainly works. There was also a guide on Sun May Sky about using Cygwin on Windows. I had some minor trouble with that so thought I’d try out the new Ubuntu bash shell that’s (a hidden) part of the latest Windows 10 builds. That seemed to work well, so I thought I’d add my own guide. [link to be added]