Part 2: Help Me Reverse Engineer An LED Light Bulb

Almost a month ago I started trying to reverse engineer an inexpensive LED color changing light bulb. With your help I’ve mapped out the circuit, and taken control of the bulb. But there’s still a few mysteries in this little blinker. Join me after the break to see what I’ve done so far, peruse the schematic and source code, and to help solve the two remaining mysteries.

What I’ve Accomplished

First off, thank you to all the commenters on the original post. I figured a lot out about this circuit because of that help. Notably, that the code I had dumped wasn’t any use because the lock bits had been set. There was also a lot of constructive input and conjecture about this when I shared it at the Sector67 meeting on Tuesday (a hackerspace here in Madison).

I’m happy to say that I was able to program the ATtiny13 chip while in place. I damaged the first bulb I cracked open by drilling through an inductor. The second time I was more careful, and soldered ribbon cable onto each of the microcontroller pins.

I can program this chip without removing it from the board. This is accomplished by using High Voltage Serial Programming (HVSP) while AC power is not connected. I reset the fuses to factory settings to enable the reset pin but I have been unable to program this using ISP. But that’s not really a problem. The diffuser was taped in place and I added an IDC connector for easy interface with the bulb.

The firmware I’ve written is up on GitHub. It has a few features; the default operation is to fade between red and green every 20 minutes as a porch light during this Christmas season. I’ll discuss the circuit below, but there are two unused pins on the device and I’ve added two test modes that are entered by jumping the pin to ground on the IDC connector. One of the test modes makes the red/green fader happen every 2 seconds. The other scrolls through primary and secondary colors with a 1/2 second delay.

So what we have is a microcontroller that drives two RGB LED modules in series. This chip has two available pins and 1K of programming space. So it should be relatively simple to make this into an I2C addressable module. Ideally this would be done without using AC power, sparking one of the questions I ask at the bottom of the post.

The Circuitry

I traced out the circuit board and recreated the schematic using an Ohmmeter and continuity Tester. There are two separate schematics, one for the LED control circuitry and another for the power supply.

As expected, the power supply uses the example circuit from the LNK304 datasheet. The 12V output connects to the two VCC points on the controller schematic but the ground or return path is a bit peculiar. Look at the upper leg on the PSU schematic which includes R2, R3, R10, and C7. I’ve labeled this as ‘GND (5V rail)’ because this connects to the ground side of the ATtiny13. The ‘GND (12V rail)’ connects to the low side of the LEDs but that is separated from the microcontroller ground path. Obviously the Zener diode is clamping power input for the microcontroller (which needs 5V), but I have no idea how the filter circuit leading back to the AC hot is working.

Take a look at the component list and then see if you can help solve two questions.

  • R1 – inline with center conductor of light socket; ~0.5 Ohm. Might be a fuse
  • R2 – 1004
  • R3 – 1004
  • R4 – 3001
  • R5 – 1302
  • R6 – 1201
  • R7 – 1Bx
  • R8 – 270
  • R9 – 270
  • R10 – 1003
  • D1 – 1N4007
  • D2 – 1N4007
  • D3 – R106 TF
  • D4 – Looks like a zener
  • D5 – RGB LED
  • D6 – RGB LED
  • D7 – JF S1J
  • IC1 – PNP Transistor
  • IC2 – PNP Transistor
  • IC3 – PNP Transistor
  • IC4 – LNK304GN AC/DC switching converter
  • IC5 – ATtiny13
  • C1 – smd without label
  • C2 – 50V 22 uF electrolytic
  • C3 – 400V 4.7 uF electrolytic
  • C4 – 400V 4.7 uF electrolytic
  • C5 – 25V 100 uF electrolytic
  • C6 – smd without label
  • C7- smd without label
  • L1 – 102J CEC
  • L2 – 102J CEC

Help solve these two questions:

1. How does the GND connection for the ATtiny13 work? A complete answer will explain what the path that includes R2, R3, R10, and C7 actually does, and how it works in conjunction with the switching converter.

2. What is the easiest way to power the control circuit using DC?

Feel free to leave a comment with your thoughts. But if you’re so inclined, I’d love to read a more verbose description so post your thoughts on your own host and leave a link in the comments.

Follow Me

szczys

43 thoughts on “Part 2: Help Me Reverse Engineer An LED Light Bulb

  1. Aha! I’ve figured it out. The trick with this circuit is that it’s the reverse of what we usually expect. Usually, we think +12V, +5V, and GND. In this case, we have (in effect) GND, -5v, and -12v. What you need to do is rename your voltages as follows:

    12V output = Vcc —> GND or common
    5V GND —-> -5v
    12v GND —-> -12v

    The zener diode on the ATTiny13 is acting as a negative shunt regulator, and R2 and R3 (1mOhm each) drop the voltage from 120VAC to 5V. R10 and C7 are there to smooth the current passing through D4.

    The outputs on the ATTiny drive the PNP transistors, sinking current into the ATTiny (and then out through the Tiny’s GND pin). The transistors in turn drive the LEDs.

    The fact that you’re dealing with a negative-voltage regulator makes it a bit trickier to drive it with DC–you’ll have to tap into the -12V and -5V lines on a hacked PC PSU, if it’s got them (many modern PSUs don’t).

  2. 1.
    It seems like a capacitive net power supply.
    The Cap C7 works as a resistor for AC.
    The Cap C6 buffers the voltage.

    2.
    You could use 5V and 12V, but anything says me this answer won’t help you.
    I think the most easy way to do it would be to feed a small 12V into the circuit and get 5V over a small preresistor to the Anode of D4.
    D4 is a important part in the capacitive power supply, it prevents the voltage getting higher than 5V.

    apexys

  3. To answer question one:

    R2 and R3 provide resistance heading into and RC circuit (R10 and C7) The purpose of this is to keep the path to ground from being a short circuit. Remember that current follows the path of least resistance. If you removed the resistors and RC circuit current would prefer that path over the path into the circuit. An explanation of RC circuits:

    http://en.wikipedia.org/wiki/RC_circuit

    I believe this circuit is filtering the AC signal filtering before going to ground.

  4. I have worked with these Linkswitch IC’s before.
    It is a crude method for having floating isolated GND’s for the +5,+12V. D4 is a Zener probably a 5.1Volt.
    Also keep in mind that D1,D2 only provide for half-wave(full is better)rectification and hence the main reason for C7 it acts as a filter by removing some of the AC component(noise). R1 limits the inrush current when power is applied. R2, R3, R10 limit the current to the ATtiny. They used threee series resistors to do this rather than 1 large resistor, this is common practice in many designs. I assume that R1 is on the Neutral and D2 is on the line side.

    To power the control circuit with just DC, remove D1,D2 then jumper the solder pads. You can remove R1 then move R3,D1 junction to your 12V GND rail then apply about 140-400 Vdc accross C3.

    Hope this helps

    Mike

  5. from what i can tell R1 is connected to live (hot). Vcc is 12v and what you have labelled as “GND (5v)” will actually be 7v (5v lower than 12v).

    C7 and R10 are acting as a low pass filter. normally this would produce approx 0v from A/C but the addition of the two high value resistors R2 and R3 means that only very small currents will flow though the filter and it is therefore possible for the zener diode across the attiny to clamp the filter output to 7v.

    Think about this. If the filter output goes below 7v, current flows from the 12v line into C7, raising the voltage. The voltage shouldn’t want to go above 7v because a filtered a/c signal gives 0v (provided you have a good quality, unbiased supply).

    This trick only works for the tiny current that the attiny consumes. If it sank a significant current then this circuit would be less well regulated.

    To power this direct from DC, simply cut out the a/c supply circuit and provide 12v to where you labelled 12v/Vcc, supply 7v to where you labelled “GND (5v)” and 0v to GND. You may need to remove the zener diode too.

  6. D4 Is only creating the 5 v potential for the processor on the negative AC cycle. Does the processor shut down on the positive half? To me it looks like D4 is forward biased on the positive portion of the AC cycle and C6 would discharge. During the negative portion 5V GND is at 7V with reference to the 12V output. Is there a diode missing from this circuit?

    To run this from DC it looks like you would remove R2 and tie the R10 side to your 12V ground then feed your 12V supply across C5.

  7. @Mohonri: You’re right I think. It’s -5V and -12V with a common ground. That explains the configuration of the switching transistors.

    For the -5V supply, R2, R3, R10, and C7 simply apply a phase shift to the rectified mains frequency which is then shunt regulated by the zener. Other then the first rectified diode it’s entirely separate from the 12V supply effected by the LNK304.

  8. None the less it is being used that way in this case.

    @Szczys to power the circuit from 12V DC, connect negative to R6, positive to pin 8 if IC5 and I would try adding a roughly 360 ohm resistor between R6 and pin 4 of IC5.

  9. What the crap?! How did I not know you’re in Madison? I feel like I know a celebrity..

    I also kinda feel like a cad, as I hardly do any hacking at all. I’m just not inspired – the sort of hacker that is happy to help others but too lazy for my own ideas. I must try to check out Sector67 (1/4, it looks like) even though I’m actually living in Eau Claire now.

  10. there is a similar circuit in Elektor Special Projects Magazine LEDs 1

    it costs £9.90 in the UK
    I bought it yesterday after buying a LED light bulb that I received and installed today – these things are going to take off as they are only 4 watts but give good lumens, I am going to try it in the dark when I get home soon

  11. @xilo
    You’re not alone in Wisconsin. I’m up in the Wautoma area, not far from Stevens Point. I too have been meaning to get to the hackerspace in Madison, just don’t have the time. :-)

  12. you should be able to convert a system with common ground, -5v, -12v into a +5v,+12v system, if you can separate the ground in the -5v part of the system from the ground in the -12v part of the system. (ground of course being vcc in your picture)
    i didn’t have a look at the circuit board, but your led-control.png looks like you could remove vcc from pin 8. then you should be able to feed 5v to pin8, +12v to what you labeled vcc in the led part of this, and connect the two gnd (-5v,-12v) to a common ground.
    oh, and cut of the traces to the psu part, just in case.

  13. project thoughts: how hard would it be to make these rf contolled? I Have been watching and think I need to play with these too. my 2 things I’d be looking to do is bump up the brightness buy having 1 control more RGB Leds and then also make a couple addressable over rf so I could remotely control the color in different areas and sync them.
    But I have no clue how complicated it would be. :(

  14. I support Brian’s recommendation

    For those having trouble thinking that the LNK304 can supply negative voltage, think of it instead as if the ATTiny’s VCC is at 12V and the ‘ground’ is actually at +7V relative to ground from the LNK304. Brian’s change in where R10 is hooked is simply to allow current to flow to the LNK304’s ground so that the zener may continue regulating voltage to the ATTiny (no need for 12V and 7V power, just 12V)

    to be honest I don’t know why the design isn’t made this way to begin with.

  15. @tgtomm – Not correct, look at the list of topologies, it does support some topologies that produce negative voltages.

    From the looks of it, this is the “High side buck-boost, direct feedback” topology.

    Of course, when dealing with a nonisolated supply such as this, in some ways it is dangerous to even use the term “ground” as there really isn’t any proper ground in this circuit.

  16. @jerm1386: because I suspect the microcontroller might want about 20mA or so given the switch configuration so the total would take it over the limit of that switcher IC.

    Incidentally, the switch configuration is pretty clever. The transistors don’t go into saturation which means they can be switched off fast despite being very ordinary – great for PWMing the LEDs without heating up and the emitter resistor helps do current limiting duties for the LED chain at the same time. So two resistors saved per LED.

  17. @Mike Szczys,

    Let me attempt to analyze what I see here…

    R1- Generally for a pluck-n-chuck component a fuse is not used. However, this may be a power handling resistor. it’s not good practice to allow a circuit direct interaction with it’s power supply, so R1 likely just serves that purpose or it filters high frequencies. Please post a pic of R1.

    R2-3 drop current for the RC bandpass for the 5V ground rail This keeps high freqs out of the bulb and allows for more steady power.

    D1 and D2 act as a 1/2 wav rectifier for the circuit.

    C3, L1, and C4 act as a power filter to provide clean input to the LNK304GN chip.

    The LNK304 chip appears to be a wide range (85V-265V) provides power limiting, surge protection, short protection, and filtering.
    I found this circuit in the LNK304 datasheet
    http://i236.photobucket.com/albums/ff111/DrivingTibNaked/Screenshot-13.png

    It looks like they pretty much copied the entire power supply out of the book.

    As for the led control circuit…
    D4 limits voltage, C6 purifies voltage. IC5 functions as a signal initiator for the ICs.

    I take it that IC1,2,and 3 are likely MOSFETS which supply power to D5 and D6.

    It looks to me that D4 and C6 are a part of the power supply circuit.

    I would take a measurement at IC5 pin 8 to determine what power it is running. It looks like it is 12V in and likely ground for the ATTiny13 is riding around 7V which would allow for a total of 5V difference

    D4 could be used to regulate voltage to IC5. It (in a poorly designed circuit)

    So, in order to run this setup, you would apply

    5V to pin 8 ATTiny
    12V to R7, R8 and R9
    Ground to R6 and ATTiny13 pin 4.

    however, in order to run this setup you’d have to replace the ICs with NPN and have the ATTiny output ground.

    So, for a easier method of changing it, you could always apply 12V to everything and then use a power regulator on the ground of the ATTiny to bring it up to 7V..

    Or even simpler, apply 12V to Attiny, The R789’s and apply ground to the R6 and ATTiny, but use a potentiometer to resist ground on the ATTiny.

  18. Mike is on the money,

    It’s a classic capacitive dropper (aka “Wattless dropper”). R2 and R3 are to prevent an initial current surge when voltage is applied. There are normally two of them to get the required volts withstand for mains application. The actual “dropper” is the capacitor C7, and R10 is a safety resistor to discharge it so users don’t get a bite from the exposed plug. I built some LED nightlights like this in old CFL cases.

  19. Except mikes method requires 80vdc and changing several components.

    My method would allow for 12vdc with only a couple of wires and a potentiometer, or a voltage regulator or change the two transistors

  20. I think both [Mike] and [Adam Outler] have compelling and complete explainations.

    @Adam Outler: How can I tell for sure if IC1, IC2, and IC3 are Mosfets? Here’s the best picture I can get of those components (click to enlarge):

    Also, when you suggest a potentiometer on the ground side of the ATtiny13, how would that work? Like using a voltage divider?

  21. To use with DC, remove all on ‘led-psu’, exept C5,
    add resistor between GND(5V) and GND(12V), something
    around 330ohm 0.5w and increase C6 value.
    Put 12v power at C5 and check voltage on C6 during
    operation, adjust (decrease) the new resistor if needed, be carefull with D4/resistor max power.
    If there is no resistor between µC and IC1/2/3, they
    must be mosfet.

    SeB.

  22. Nah, they’re definitely PNP’s. If they were FETs, the S-D voltage would drop when they switched on putting them into their linear region causing them to waste energy.

    The base current is limited by the emitter resistor (saves a resistor). But also the base current is limited by the emitter coming close to the -5V rail preventing them from saturating so they can switch off quick (saving another resistor).

  23. Scratch that last comment. I just saw the picture in the comments above. Four pins and labelled as ICs… I think they might be Siemens/Infinion BCR116 pre-biased NPN transistors (a single transistor with a series base resistor and a smaller B-E resistor to prevent saturation).

    http://bit.ly/ePhN0P

    Out of interest, what’s the voltage across the LED pairs when they are lit up?

  24. use a voltmeter to determine the input voltage and contact points and solder on wires and hook it up to a dc source with the wires and this is coming from a 12 year old im starting my career young lmao

  25. nes is correct. They are NPN transistors, not mosfets. I made an assumption based on the fact that they are driving an efficient platform with a microprocessor. Generally people keep the signal load to a minimum and use the transistors to do the work. In this case they are using the tiny to turn on the transistors. Personally, I would have driven MOSFETS as they are more designed to be a driver. There’s alot of ways to do it though. I was just thinking what I would use in that situation.

    This looks the easiest
    http://i236.photobucket.com/albums/ff111/DrivingTibNaked/led-controlnew.png

    I didn’t think about it earlier, but you may want to add a small resistor to that 7v circuit to prevent over current while the capacitor charges.

  26. Nes,Adam, they may be p-mosfet with Vgs>-5v .
    I doubt they are NPN, PNP is ok for me.
    They are driven ON with 0 logic level on µC pin,
    ie with Vgs=-5v or Vbe=-5v (with base resistor in
    the package).
    SeB.

  27. A couple thoughts.

    Resistor markings: the last digit is the number of zero’s appended to the preceeding digits. In the case of R2 and R3, “1004” translates to 1000000 Ohms (or 1M Ohm). “3001” translates to 3k Ohm.

    The schematics don’t show what C7/R10 connect to off-page, but I’m guessing this is a signal input circuit, not a power supply.

    Even in a short circuit condition, 2M Ohm series resistance allows only 85uA current at 170V. Controller clamp diodes on input pins would limit the voltage at the pin to Vcc+0.7V and GND-0.7V. You should be able to see this with an oscilloscope (careful with grounding!) at the R10/C7/ATTiny13 node. R1 is likely a “fuse” in case a transient on the power damages (shorts) silicon somewhere.

    This is a way to allow the controller to know when the AC line has crossed 0V. This might be helpful with dimming or timing.

    Since the controller doesn’t have a crystal or resonator attached, it must rely on an internal RC clock source. The speed of such clocks can change greatly with temperature and Vdd. It wouldn’t take much of a leap to use the AC line frequency to recalibrate the internal clock speed every second or ten.

    D4 is likely a Zener diode about 5.1V. You should be able to measure it with a multimeter.

    The Gnd (12V Rail) is also the ground for the 5V rail. The 5V rail is likely developed using D4 5.1V Zener?) and a series current limiting resistor (not shown) tied to the 12V (-12V?) supply.

    Most of this holds even if the “VCC” supply of the ATTINY13 circuit is really GND and “GND(12V) is really -12V.

  28. The emitter resistors R7, R9, and R8 allow you to regulate the collector current depending on the base voltage. The base current will be tiny (Ib=Ic/beta, beta is usually about 20 to 100).

    If PB4 is high/open: Vb<0.7V, Ve=0V, Ib=0, Ic=0

    If PB4 is low(-5V): Vb=-5.0V, Ve=-4.3V, R8=27 Ohm ("270"), Ie=160mA, (and assuming beta=100) Ib=0.16mA.
    The only real unknown is beta, but even that's not critical.
    The LED current is about 160mA, independent of where GND (-12V?) really is, or how many LEDs are in the string.

    By the way, 2 blue LEDs develop about 8V when lit, so "VCC" and "GND" have to be at least 8V apart. That tends to fit with Ve=4.3V. So, is the 12V supply really 12V, or is it a little higher (closer to 13V)? Adjusting the R4/R5 divider would change that.

Leave a Reply to nesCancel reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.