"Hacking" firmware of off the shelf ESP based products

[snackpack]

Being very deep into home automation, and now re-entering the reef hobby, I've been thinking of ways to cross the two hobbies. I've come up with very little in my searching, but Google seems to pigeonhole you into whatever they want these days making it difficult to wander off the beaten path.

Has anyone explored reflashing off the shelf products with open source firmware such as Tasmota or Esphome? I've recently purchased a few of the newer M-series Jebao pumps/wavemakers. Cracked open the controller for my MDP-20000 and found an ESP8266 for wifi. I'm assuming the controllers for the two MLW-30's I just bought have the same or similar chips.

I'm working on re-tooling a dedicated Home Assistant server into what I'm dubbing "Reef Assistant". I've got a bunch of esp8266/esp32 boards monitoring and controlling basic functions, but am ready to start going a little deeper with this. Before I start bricking controllers, has anyone come across working instances of reflashed hardware? Pumps, wavemakers, automatic feeders, lights, etc etc.

I'm very hopeful for this project - my wife's ReefLED 50 is ESP based, my AI Hydra 26HD's seem to be ESP based, and I know there's ESP based automatic feeders on Amazon that I'm tempted to toy with, as well as the wifi Jebao stuff.

If no one has seen anything like this, but there's interest in it on the forum, I'm also considering starting a YouTube channel to document my journey and throw some tutorials out there for the community (and probably get some sternly worded C&D letters from some manufacturers).

 

[Projects with Sam]

Being very deep into home automation, and now re-entering the reef hobby, I've been thinking of ways to cross the two hobbies. I've come up with very little in my searching, but Google seems to pigeonhole you into whatever they want these days making it difficult to wander off the beaten path.

Has anyone explored reflashing off the shelf products with open source firmware such as Tasmota or Esphome? I've recently purchased a few of the newer M-series Jebao pumps/wavemakers. Cracked open the controller for my MDP-20000 and found an ESP8266 for wifi. I'm assuming the controllers for the two MLW-30's I just bought have the same or similar chips.

I'm working on re-tooling a dedicated Home Assistant server into what I'm dubbing "Reef Assistant". I've got a bunch of esp8266/esp32 boards monitoring and controlling basic functions, but am ready to start going a little deeper with this. Before I start bricking controllers, has anyone come across working instances of reflashed hardware? Pumps, wavemakers, automatic feeders, lights, etc etc.

I'm very hopeful for this project - my wife's ReefLED 50 is ESP based, my AI Hydra 26HD's seem to be ESP based, and I know there's ESP based automatic feeders on Amazon that I'm tempted to toy with, as well as the wifi Jebao stuff.

If no one has seen anything like this, but there's interest in it on the forum, I'm also considering starting a YouTube channel to document my journey and throw some tutorials out there for the community (and probably get some sternly worded C&D letters from some manufacturers).

that sounds awesome! I mess around a little with Arduinos but nothing as hardcore as what you're talking about.

 

[theatrus]

Don’t have anything to share on this, but pay attention to what the ESP8266/32 is doing in the circuit.

Is pump speed just PWM and pin on/off signals, or does it use a serial link to a different controller? Etc.

There are a bunch of ways to approach this, and since the WiFi is usually still an addon expect some serial busses to dominate if there is more than one microcontroller.

It’s a good reverse engineering project. Feel free to dig into one and post pictures of the board, etc and multiple people can try to figure out what’s happening. If you have various other tools (oscilloscope, etc) it would be super helpful. Also feel free to ping me if you’re stumped on something.

 

[oreo54]

Don’t have anything to share on this, but pay attention to what the ESP8266/32 is doing in the circuit.

Is pump speed just PWM and pin on/off signals, or does it use a serial link to a different controller? Etc.

There are a bunch of ways to approach this, and since the WiFi is usually still an addon expect some serial busses to dominate if there is more than one microcontroller.

It’s a good reverse engineering project. Feel free to dig into one and post pictures of the board, etc and multiple people can try to figure out what’s happening. If you have various other tools (oscilloscope, etc) it would be super helpful. Also feel free to ping me if you’re stumped on something.

Believe esp32 ect have built in wifi and Bluetooth.
Does not have a rtc though .
And suspect other add ons that probably use i2c.

My custom board error

a looped boot due to an error accessing the i2c bus RTC chip MCP7940.

 

[oreo54]

Being very deep into home automation, and now re-entering the reef hobby, I've been thinking of ways to cross the two hobbies. I've come up with very little in my searching, but Google seems to pigeonhole you into whatever they want these days making it difficult to wander off the beaten path.

Has anyone explored reflashing off the shelf products with open source firmware such as Tasmota or Esphome? I've recently purchased a few of the newer M-series Jebao pumps/wavemakers. Cracked open the controller for my MDP-20000 and found an ESP8266 for wifi. I'm assuming the controllers for the two MLW-30's I just bought have the same or similar chips.

I'm working on re-tooling a dedicated Home Assistant server into what I'm dubbing "Reef Assistant". I've got a bunch of esp8266/esp32 boards monitoring and controlling basic functions, but am ready to start going a little deeper with this. Before I start bricking controllers, has anyone come across working instances of reflashed hardware? Pumps, wavemakers, automatic feeders, lights, etc etc.

I'm very hopeful for this project - my wife's ReefLED 50 is ESP based, my AI Hydra 26HD's seem to be ESP based, and I know there's ESP based automatic feeders on Amazon that I'm tempted to toy with, as well as the wifi Jebao stuff.

If no one has seen anything like this, but there's interest in it on the forum, I'm also considering starting a YouTube channel to document my journey and throw some tutorials out there for the community (and probably get some sternly worded C&D letters from some manufacturers).

May want to start here ....

https://www.allaboutcircuits.com/projects/update-the-firmware-in-your-esp8266-wi-fi-module/

Although it's rarely mentioned on the Web, Espressif, the designers of the ESP8266 integrated circuit, have created a specific piece of software to update the firmware in their chips. It's the ESP Flash Download Tool

Though I have about the skill of a 3 yr old l managed to reflash an esp based driver/ controller... Very fiddly process

 

[theatrus]

May want to start here ....

https://www.allaboutcircuits.com/projects/update-the-firmware-in-your-esp8266-wi-fi-module/

Though I have about the skill of a 3 yr old l managed to reflash an esp based driver/ controller... Very fiddly process

Yup. One of the important things to tr y to find are the ESP serial pins and reset/mode/boot pin, and see if you can at least see debug output. These will all be logic level (3.3V), but the FTDI adapters make it easy to connect. Depending on how the product was built, you may need to solder to pins on the board, or make a header, etc.

 

[jtm235]

Being very deep into home automation, and now re-entering the reef hobby, I've been thinking of ways to cross the two hobbies. I've come up with very little in my searching, but Google seems to pigeonhole you into whatever they want these days making it difficult to wander off the beaten path.

Has anyone explored reflashing off the shelf products with open source firmware such as Tasmota or Esphome? I've recently purchased a few of the newer M-series Jebao pumps/wavemakers. Cracked open the controller for my MDP-20000 and found an ESP8266 for wifi. I'm assuming the controllers for the two MLW-30's I just bought have the same or similar chips.

I'm working on re-tooling a dedicated Home Assistant server into what I'm dubbing "Reef Assistant". I've got a bunch of esp8266/esp32 boards monitoring and controlling basic functions, but am ready to start going a little deeper with this. Before I start bricking controllers, has anyone come across working instances of reflashed hardware? Pumps, wavemakers, automatic feeders, lights, etc etc.

I'm very hopeful for this project - my wife's ReefLED 50 is ESP based, my AI Hydra 26HD's seem to be ESP based, and I know there's ESP based automatic feeders on Amazon that I'm tempted to toy with, as well as the wifi Jebao stuff.

If no one has seen anything like this, but there's interest in it on the forum, I'm also considering starting a YouTube channel to document my journey and throw some tutorials out there for the community (and probably get some sternly worded C&D letters from some manufacturers).

I can offer an alternative to hacking the firmware... You can get toss the controller it came with and get BLDC 3-phase controllers on amazon and control them with a RaspberriPi, all for around $50...This is what I am doing for all my BLDC pumps. Here are the controllers:



I also hardware-hacked the ReefLED 90....hahah this one was interesting...they have two boards inside...the top board is the digital controller and the bottom board is the LED driver...I was able to ditch the top board and control everything with an arduino Nano and a 4 channel digital-to-analog converter (DAC):

 

[oreo54]

I can offer an alternative to hacking the firmware... You can get toss the controller it came with and get BLDC 3-phase controllers on amazon and control them with a RaspberriPi, all for around $50...This is what I am doing for all my BLDC pumps. Here are the controllers:



I also hardware-hacked the ReefLED 90....hahah this one was interesting...they have two boards inside...the top board is the digital controller and the bottom board is the LED driver...I was able to ditch the top board and control everything with an arduino Nano and a 4 channel digital-to-analog converter (DAC):

Curious as to why the need for a DAC?
Pics of top and bottom board.

Red Sea ReefLED 90 Electronic Board Top

Red Sea ReefLED 90 Electronic Board Top, R35172

fishtanksdirect.com

I agree it " might" be easier just to get a new esp board...
.
Cheap enough.

Just for an fyi you don't need a rtc since one can access network time servers.

Oh another fyi:
My ftdi boards default was 5v with 3.3v capability if a solder jumper was removed.

The esp is comfortable with multiple program languages.

https://just-the-docs.github.io/physcomp/esp32/esp32.html#:~:text=using%20the%20Huzzah32.-,Programming%20environment,IDF)%20or%20VSCode%20with%20PlatformIO.

I never saw it stated ( may have missed it or it is " common knowledge) but my " guy" recommended "erase" B4 reflashing.

 

[oreo54]

By removing and replacing you never " brick" your original.

Depends on the orig. board design I guess
If like the above light... 2 separate boards one brains the other brawn.

 

[theatrus]

I can offer an alternative to hacking the firmware... You can get toss the controller it came with and get BLDC 3-phase controllers on amazon and control them with a RaspberriPi, all for around $50...This is what I am doing for all my BLDC pumps. Here are the controllers:



I also hardware-hacked the ReefLED 90....hahah this one was interesting...they have two boards inside...the top board is the digital controller and the bottom board is the LED driver...I was able to ditch the top board and control everything with an arduino Nano and a 4 channel digital-to-analog converter (DAC):

Yeah, that’s the modularity aspect. Figure out what you need to control with and just replace that section.

The BLDC pump controllers do have universal options now which is nice. Tuning motor drivers is always a pain so I’m glad someone did the work on that

 

[jtm235]

Curious as to why the need for a DAC?
Pics of top and bottom board.

Red Sea ReefLED 90 Electronic Board Top

Red Sea ReefLED 90 Electronic Board Top, R35172

fishtanksdirect.com

I agree it " might" be easier just to get a new esp board...
.
Cheap enough.

Just for an fyi you don't need a rtc since one can access network time servers.

Oh an fyi:
My ftdi boards default was 5v with 3.3v capability if a solder jumper was removed.

There are 8 pins on the top of the bottom board...I am referring to the red PCB below the top PCB (not the LED diode chip which has 10 pins (Blue 1 +/-, Blue 2 +/-, White +/-, Moon +/-, Thermistor +/-) and is connected to the bottom PCB). The bottom red PCB is the LED driver...essentially designed to provide the proper current to each LED channel This is the pinout on the top of the bottom PCB:

1: 24v+
2: 24v+
3: Ground
4: Ground
5: Analog Control for Moon
6: Analog Control for White
7: Analog Control for Blue
8: 3.3V for Thermistor on LED chip

Pins 5, 6 and 7 require a very specific voltage range to drive the LEDs properly so you don't burn your diodes out. If you simply try to provide unregulated (not constant current) 24v directly to the LED chip...you may injure yourself or start a fire. You absolutely need a proper LED driver (constant current) to run these high-power LED chips. I derived the specific voltage ranges by checking the pins' voltage with a multimeter when using the reefbeat app to set each channel at 1% and 100%. I don't know them off the top of my head so I wont say what they are, but I know they are all less than 3.3V.

I can provide photos if anyone wants. Also I should mention that temperature regulation is critical on these units. There is a 5V PWM fan that needs to be on when this starts kicking out wattage.

 

[theatrus]

There are 8 pins on the top of the bottom board...I am referring to the red PCB below the top PCB (not the LED diode chip which has 10 pins (Blue 1 +/-, Blue 2 +/-, White +/-, Moon +/-, Thermistor +/-) and is connected to the bottom PCB). The bottom red PCB is the LED driver...essentially designed to provide the proper current to each LED channel This is the pinout on the top of the bottom PCB:

1: 24v+
2: 24v+
3: Ground
4: Ground
5: Analog Control for Moon
6: Analog Control for White
7: Analog Control for Blue
8: 3.3V for Thermistor on LED chip

Pins 5, 6 and 7 require a very specific voltage range to drive the LEDs properly so you don't burn your diodes out. If you simply try to provide unregulated (not constant current) 24v directly to the LED chip...you may injure yourself or start a fire. You absolutely need a proper LED driver (constant current) to run these high-power LED chips. I derived the specific voltage ranges by checking the pins' voltage with a multimeter when using the reefbeat app to set each channel at 1% and 100%. I don't know them off the top of my head so I wont say what they are, but I know they are all less than 3.3V.

I can provide photos if anyone wants. Also I should mention that temperature regulation is critical on these units. There is a 5V PWM fan that needs to be on when this starts kicking out wattage.

I assume the question was "most LED drivers are PWM dimming driven" and not analog control, but its possible the drivers are all analog voltage controlled. Would need to see the drivers.

And you do bring up a good part of the control replacement, in this case there is a thermal control (for the fan) and probably a thermal cutout you'd need to replicate (when temperature goes too high, because the fan will fail).

 

[jtm235]

I assume the question was "most LED drivers are PWM dimming driven" and not analog control, but its possible the drivers are all analog voltage controlled. Would need to see the drivers.

And you do bring up a good part of the control replacement, in this case there is a thermal control (for the fan) and probably a thermal cutout you'd need to replicate (when temperature goes too high, because the fan will fail).

Right, it took me some trial and error to learn these drivers are analog driven. I tried to replicate the voltage ranges via PWM and it did not work, glad I didn't fry anything TBH. I'm still not 100% sure how the fan is regulated because the thermistor circuit does not go back to the top board...I suspect the thermistor is a physical cutoff switch in the driver board and the fan speed is selected by the calculated wattage.

 

[theatrus]

Right, it took me some trial and error to learn these drivers are analog driven. I tried to replicate the voltage ranges via PWM and it did not work, glad I didn't fry anything TBH. I'm still not 100% sure how the fan is regulated because the thermistor circuit does not go back to the top board...I suspect the thermistor is a physical cutoff switch in the driver board and the fan speed is selected by the calculated wattage.

Likely then on the thermistor. Could be a comparator or sometimes a feedback circuit to drop power as the thermistor warms. In some way its nice to know its purely driven by the driver (less firmware to fail)

 

[jtm235]

Likely then on the thermistor. Could be a comparator or sometimes a feedback circuit to drop power as the thermistor warms. In some way its nice to know its purely driven by the driver (less firmware to fail)

I don't think there's any feedback to the top board...unless it's monitoring the current supplied to the thermistor...which leads me to believe the cutoff switch is mechanically driven. Strangely enough too...it runs without the thermistor getting any voltage. I'll do some tests to confirm this how this works.

 

[oreo54]

You do know most meters average voltage so 3.3v pwm at 1/2 duty cycle shows up as 3.3/2 = 1.64 v on most " normal" meters .

And " zero" doesn't always mean zero volts just voltage below the driver cutoff..

Not saying you are wrong just an o scope is usually needed or the spec sheet

 

[jtm235]

You do know most meters average voltage so 3.3v pwm at 1/2 duty cycle shows up as 3.3/2 = 1.64 v on most " normal" meters .

And " zero" doesn't always mean zero volts just voltage below the driver cutoff..

Not saying you are wrong just an o scope is usually needed or the spec sheet

Yes... and I had no reason to assume the readings from the top board weren't PWM (because like theatrus said...most LED drivers are PWM controlled). I sent a PWM signal at the expected duty cycle range in 3.3v and nothing happened, one light flickered...then I tried sending analog signals and they lit up as expected.

 

[theatrus]

Yes... and I had no reason to assume the readings from the top board weren't PWM (because like theatrus said...most LED drivers are PWM controlled). I sent a PWM signal at the expected duty cycle range in 3.3v and nothing happened, one light flickered...then I tried sending analog signals and they lit up as expected.

There are definitely analog controlled LED drivers, or ones that work with either input. Good test

 

[oreo54]

Yes... and I had no reason to assume the readings from the top board weren't PWM (because like theatrus said...most LED drivers are PWM controlled). I sent a PWM signal at the expected duty cycle range in 3.3v and nothing happened, one light flickered...then I tried sending analog signals and they lit up as expected.

Sounds reasonable ...
Get the numbers of the driver ic by any chance?.

Popbloom sells a knockoff.
Except for the diode board very different.
They use linear drivers btw.

 

[All_talk]

I can offer an alternative to hacking the firmware... You can get toss the controller it came with and get BLDC 3-phase controllers on amazon and control them with a RaspberriPi, all for around $50...This is what I am doing for all my BLDC pumps. Here are the controllers:



I also hardware-hacked the ReefLED 90....hahah this one was interesting...they have two boards inside...the top board is the digital controller and the bottom board is the LED driver...I was able to ditch the top board and control everything with an arduino Nano and a 4 channel digital-to-analog converter (DAC):

Have you measured power consumption/water flow compared to the pumps original controller?

I have read about others using generic BLDC controllers but most seem to see diminished output from the pump. Presumably due to the controller parameters not being well matched to the specific pump. What is your experience? Any issues with controlling at low speed, stalling or motor heat?