Modifying IKEA Tradfri Sensor (E1525) timeout help wanted
-
Hi all
I am a complete noob, so please bear with me. I found this forum searching for an IKEA sensor hack, so seems like a good place to ask. Also, I hope everyone is keeping well in this climate.
I have an older E1525 IKEA Tradfri motion sensor. The one with the dial on the back for timeout. The minimum setting available on this unit is 60 seconds, as can be set from the dial on the back that shows 1, 5, 10 (minutes). The problem is, that I find 60 seconds is not very useful when hooked up to something like Home Assistant as the sensor will show as 'Detected' for 60 seconds after motion has stopped. I get that the design makes sense when using Touchlink, but I don't.
I was reading here: https://community.smartthings.com/t/making-xiaomi-motion-sensor-a-super-motion-sensor/139806 that the Xiaomi Aqara sensor also has a minimum 60 second timeout, but was modified to be ~5 seconds. So I found myself here
I would very much be grateful for some input on if this could be achieved with this sensor too.It appears that the dial is just a plain potentiometer marked B104. My first thought (and what I really hoped) was that the minimum resistance would not be zero, and just shorting the connections with a blob of solder might do the trick, but it looks like when it is in the '1' position, the potentiometer resistance is zero.
I could be wrong about these components but: The potentiometer seems to feed into a transistor on the other side that is marked 7002, and there is also a resistor marked '623' (or 823).
I found some photos of the PCB on twitter, as well as a couple of photos I have taken: https://imgur.com/a/UnqDxWl
So the question is: Is it possible to bypass this 60 second time out - or lower it to about 5 seconds? I am totally out of my depth here but would very much welcome any input as I enjoy the learning experience
Thank you in advance for any and all help!
-
There should be a series resistor also connected with the potmeter. Lowering that should decrease the time the sensor is active. You can just solder a resistor in parallel to it.
-
Hi! Thanks for the reply.
Ok, so I think this 'could' be the R12.
There is a leg on the potentiometer that goes to the R12, then from there to the E93196.I have uploaded another photo here showing the connections: https://imgur.com/a/lylSQko
According to this: http://www.mos.co.za/downloads/e93196/e93196.pdf the leg is goes to is either 4 or 8 (sorry I cannot tell which way the chip is) but since 8 is labeled 'TEST' and 4 is labeled 'VDD', I assume it's 4.
Before I go removing / frying stuff, does this look right? Is it the resistance on the VDD leg that controls this? Would it be safe to bypass R12 and have no resistance? I am wondering if this is what the Xiaomi hack does.
-
Now that I see the datasheet I am not so sure anymore. It seems the sensor sends a message that is handled by the micro controller after it.
-
That's a shame. Is it possible to reprogram the controller? I have a CP2102 somewhere.. would this interface with a chip like that?
-
Than you would have to reprogram the entire chip, and that's quite some effort...
-
I was hoping maybe it would be a case of connecting via serial and issuing a few commands to set config options. I guess it's not.. Well I can use the sensor in a non-critical area. Thanks for taking a look for me
-
The config options would be overwritten every time by the controller itself, so there is little chance that would work. Or you have to intercept every message to the sensor from the microcontroller...
You could try one last thing and that is finding out where the other legs of the potmeter go to
-
Hi again,
Ok understood. I have traced the other 2 legs.. One looks like a common between the 2 potentiometers, so input voltage? And the other appears to go to the MCU
-
Yes, that is what I expected. The voltage level is read by the MCU and used to set options in the sensor. I don't think you can change anything with it. You could try to connect the pin that goes to the MCU, to ground. But no success guaranteed...
-
I can try - is there a possibility that I could fry it doing that?
-
if you don't connect VDD to GND, you won't. So you should measure that first.
-
Gotcha. So we know that pin 4 on the E93196 is VDD, so if I get continuity from pin 4 on the E93196 to either the potentiometer leg or the MCU pin that I am going to be connecting it to, then it's a no go?
-
Ok, this could be a no go.
Looks like I can get some continuity between these points: https://imgur.com/a/PKPOJdk
So that would be connecting connecting VDD to ground?
But, with a DMM set to 200k, I get a resistance reading of 66.7 between these points: https://imgur.com/a/4K0NPbP because of R12....
Could this be the resistance that is putting that to 60 seconds? Could I connect those 2 green points? Or remove that Resistor and bridge with solder?
-
Can you measure the voltage on the pin of the MCU that is connected to the potmeter when it is in the lowest position?
-
Sure, just to confirm though (because I've not measured anything like this before), I put one probe on the MCU pin and the other to ground? Ie. Battery negative? Sorry if this seems like a really dumb question
-
Yes like that. And make sure the meter is on voltage reading, and the plugs are also in the voltage measuring connections. So not in the current measuring ones
-
I think I may have screwed up one of the earlier measurements. I am using a better meter now, and I got this: https://imgur.com/a/AQk22sR
The Blue pin, which I originally said was connected to the VDD pin appears to actually be connected to the ground shield over the chip - I got a reading of zero. The Red pin, I got a reading of 3V (there abouts) and this is the one connected to the VDD pin on the E93196. Turning the potentiometer did not change the voltage on this.
I remeasured the resistance from the ground leg of the potmeter to top green dot is 77K, bottom green dot is zero when at 1 minute, both are at 77K when at 15 minutes
-
So is the third leg of the potentiometer still connected to the MCU input on? And what do you measure there? The voltage should change of you change the position
-
Voltages:
All 3 potmeter legs to MCU (blue): 2.9V - Does not change when potmeter moved
All 3 potmeter legs to MCU (red): ~0.2mV-0.3mV - Does not change when potmeter movedResistance:
Top green on potmeter to MCU (red): 67K (turning dial does not change)
Bottom green dot on potmeter to MCU (red): 67K at max time, 110K at minimum time
Unmarked leg to MCU (red): 110K and does not change when potmeter moved
-
It's confusing me.
The potmeter has three legs. One is positive supply (VDD probably), one is ground and the other one should change voltage of you move the dial. You should measure between ground and the point you want to measure.Edit
Now you should find out where this third leg is going to
-
Yeah sorry about that. My inexperience is probably exacerbating things
thank you for putting up with me 
I am looking at the potmeter, and I think I can fairly say the legs are like this: https://imgur.com/a/1bTBnUo
So with one probe on the variable leg, where to I test with the other probe?
It looks like the variable leg first goes to TP5_1, then to TP5_2, then to the MCU, but it is not clear which pin: https://imgur.com/a/hbgOOBU
-
@bob21 said in Modifying IKEA Tradfri Sensor (E1525) timeout help wanted:
So with one probe on the variable leg, where to I test with the other probe?
Always to ground
@bob21 said in Modifying IKEA Tradfri Sensor (E1525) timeout help wanted:
It looks like the variable leg first goes to TP5_1, then to TP5_2, then to the MCU, but it is not clear which pin: https://imgur.com/a/hbgOOBU
With the continuity function of your multimeter (when it beeps if you short the probes) you can trace where it goes to.
-
My meter doesn't beep, but I get a reading of 0.1 between TP5_2 and the second pin from the right, this seems to be the lowest reading by far: https://imgur.com/a/RLFyOBP is this a sign that it is connected here?
But, when I set the potmeter to minimum the Voltage = 2.95, and this doesn't change... the potmeter set to max is still 2.95V...
-
So, do you measure a voltage change on any of the pins of the potmeter when you change it?
And what is the type of the MCU?
-
According to the pics I found, the MCU is a Silicon Labs Mighty Gecko EFR32MG1P132GI.
With 1 probe to ground I tested:
Pos leg with dial at 1 minute (min): 2.97V
Pos leg with dial at 15 mins (max): 2.97V
Neg leg with dial at 1 minute (min): 2.96V
Neg leg with dial at 15 mins (max): 2.95V
Variable leg with dial at 1 minute (min): 2.96V
Variable leg with dial at 15 mins (max): 2.97VSeems like a very small change.. is this enough of a change to be useful?
-
I'm out of ideas, I'm giving up.
You could try to tie the variable pin to ground but it could damage your sensor
-
Ok, no worries. I'd like to thank you for spending your time on this
-
Hello everyone!
Based on the quite useful reverse engineered schematic at https://hackaday.io/project/174308-tradfri-pir-motion-sensor-hacking the measurements were somewhat sabotaged by the 2N7002 (see Connors comment "enables voltage dividers only when triggered").
the transistor is controlled by the Elmos E931.96 PIR motion controller IC.
The latter is programmable by the IKEA TRÅDFRI ICC-1 module's EFR32MG1P132F256GM32 MCU.
E.g.2. Blind Time Ignores motion after the interrupt output is switched back to 0 Range: 0.5s... 8s. The blind time is [Register Value] *0.5s 3. Programmable pulse counter 1... 4 pulses with sign change in between Amount of pulses = [Register Value] + 1 4. Window time For noisy environments 2s... 8s window Window time = [Register Value] * 2s + 2shttps://github.com/basilfx/TRADFRI-Hacking gives a good overview on that.
What is the issue with tose 60s?
