Modifying IKEA Tradfri Sensor (E1525) timeout help wanted

[bob21]

Hi all :)

I am a complete noob, so please bear with me. I found this forum searching for an IKEA sensor hack, so seems like a good place to ask. Also, I hope everyone is keeping well in this climate.

I have an older E1525 IKEA Tradfri motion sensor. The one with the dial on the back for timeout. The minimum setting available on this unit is 60 seconds, as can be set from the dial on the back that shows 1, 5, 10 (minutes). The problem is, that I find 60 seconds is not very useful when hooked up to something like Home Assistant as the sensor will show as 'Detected' for 60 seconds after motion has stopped. I get that the design makes sense when using Touchlink, but I don't.

I was reading here: https://community.smartthings.com/t/making-xiaomi-motion-sensor-a-super-motion-sensor/139806 that the Xiaomi Aqara sensor also has a minimum 60 second timeout, but was modified to be ~5 seconds. So I found myself here :) I would very much be grateful for some input on if this could be achieved with this sensor too.

It appears that the dial is just a plain potentiometer marked B104. My first thought (and what I really hoped) was that the minimum resistance would not be zero, and just shorting the connections with a blob of solder might do the trick, but it looks like when it is in the '1' position, the potentiometer resistance is zero.

I could be wrong about these components but: The potentiometer seems to feed into a transistor on the other side that is marked 7002, and there is also a resistor marked '623' (or 823).

I found some photos of the PCB on twitter, as well as a couple of photos I have taken: https://imgur.com/a/UnqDxWl

So the question is: Is it possible to bypass this 60 second time out - or lower it to about 5 seconds? I am totally out of my depth here but would very much welcome any input as I enjoy the learning experience :) Thank you in advance for any and all help!

[electrik]

There should be a series resistor also connected with the potmeter. Lowering that should decrease the time the sensor is active. You can just solder a resistor in parallel to it.

[bob21]

Hi! Thanks for the reply.

Ok, so I think this 'could' be the R12.

There is a leg on the potentiometer that goes to the R12, then from there to the E93196.I have uploaded another photo here showing the connections: https://imgur.com/a/lylSQko

According to this: http://www.mos.co.za/downloads/e93196/e93196.pdf the leg is goes to is either 4 or 8 (sorry I cannot tell which way the chip is) but since 8 is labeled 'TEST' and 4 is labeled 'VDD', I assume it's 4.

Before I go removing / frying stuff, does this look right? Is it the resistance on the VDD leg that controls this? Would it be safe to bypass R12 and have no resistance? I am wondering if this is what the Xiaomi hack does.

[electrik]

Now that I see the datasheet I am not so sure anymore. It seems the sensor sends a message that is handled by the micro controller after it.

[bob21]

That's a shame. Is it possible to reprogram the controller? I have a CP2102 somewhere.. would this interface with a chip like that?

[electrik]

Than you would have to reprogram the entire chip, and that's quite some effort...

[bob21]

I was hoping maybe it would be a case of connecting via serial and issuing a few commands to set config options. I guess it's not.. Well I can use the sensor in a non-critical area. Thanks for taking a look for me :)

[electrik]

The config options would be overwritten every time by the controller itself, so there is little chance that would work. Or you have to intercept every message to the sensor from the microcontroller...
You could try one last thing and that is finding out where the other legs of the potmeter go to

[bob21]

Hi again,

Ok understood. I have traced the other 2 legs.. One looks like a common between the 2 potentiometers, so input voltage? And the other appears to go to the MCU

https://imgur.com/a/fjbcjA3

[electrik]

Yes, that is what I expected. The voltage level is read by the MCU and used to set options in the sensor. I don't think you can change anything with it. You could try to connect the pin that goes to the MCU, to ground. But no success guaranteed...

[bob21]

I can try - is there a possibility that I could fry it doing that?

[electrik]

if you don't connect VDD to GND, you won't. So you should measure that first.

[bob21]

Gotcha. So we know that pin 4 on the E93196 is VDD, so if I get continuity from pin 4 on the E93196 to either the potentiometer leg or the MCU pin that I am going to be connecting it to, then it's a no go?

[bob21]

Ok, this could be a no go.

Looks like I can get some continuity between these points: https://imgur.com/a/PKPOJdk

So that would be connecting connecting VDD to ground?

But, with a DMM set to 200k, I get a resistance reading of 66.7 between these points: https://imgur.com/a/4K0NPbP because of R12....

Could this be the resistance that is putting that to 60 seconds? Could I connect those 2 green points? Or remove that Resistor and bridge with solder?

[electrik]

Can you measure the voltage on the pin of the MCU that is connected to the potmeter when it is in the lowest position?

[bob21]

Sure, just to confirm though (because I've not measured anything like this before), I put one probe on the MCU pin and the other to ground? Ie. Battery negative? Sorry if this seems like a really dumb question :D

[electrik]

Yes like that. And make sure the meter is on voltage reading, and the plugs are also in the voltage measuring connections. So not in the current measuring ones

[bob21]

I think I may have screwed up one of the earlier measurements. I am using a better meter now, and I got this: https://imgur.com/a/AQk22sR

The Blue pin, which I originally said was connected to the VDD pin appears to actually be connected to the ground shield over the chip - I got a reading of zero. The Red pin, I got a reading of 3V (there abouts) and this is the one connected to the VDD pin on the E93196. Turning the potentiometer did not change the voltage on this.

I remeasured the resistance from the ground leg of the potmeter to top green dot is 77K, bottom green dot is zero when at 1 minute, both are at 77K when at 15 minutes

[electrik]

So is the third leg of the potentiometer still connected to the MCU input on? And what do you measure there? The voltage should change of you change the position

[bob21]

Voltages:

All 3 potmeter legs to MCU (blue): 2.9V - Does not change when potmeter moved
All 3 potmeter legs to MCU (red): ~0.2mV-0.3mV - Does not change when potmeter moved

Resistance:

Top green on potmeter to MCU (red): 67K (turning dial does not change)
Bottom green dot on potmeter to MCU (red): 67K at max time, 110K at minimum time
Unmarked leg to MCU (red): 110K and does not change when potmeter moved