Hacking IKEA trådfri lighting automation

I recently visited IKEA again and got interested in their affordable line of home automation/LED lighting products called TRÅDFRI (meaing wireless in a play-with-words kind of Swedish). Of course there was already an internet community active in hacking these devices and I joined in.

Getting started

I installed the gateway and after pairing devices to switches and switches to the gateway I finally could get around and experiment. I found quite a good introduction into hacking the gateway by sending your own commands here: PIMORONI: Controlling IKEA Trådfri Lights from your Pi – however after a couple of hours trying I had to notice that something in the description was heavily outdated.

During 2017 IKEA had reacted to some early security issues and introduced a new layer of safety in the user identification scheme. This had in the meantime been fixed in the underlying GIT repository by Harald van der Laan but sincePimoroni had insisted on improving the original code in their own fork, this new change was of course not reflected in their code which I had tested and failed with. In the mean time I have been in contact with Pimoroni and they told me that they are working on an updated version.

Control from a Raspberry

Well I don’t know what the original improvements to the code from Harald van der Laan might have been, but after cloning his repository onto the Raspberry Pi I ad been using for my experiments, everything worked out quite well and only a couple of minutes later I was controlling my first lamps from the commandline in a Putty terminal:

Putty terminal showing the communication with the IKEA TRÅDFRI gateway.

Hardware hacking

It didn’t take me long to disassemble a GU10 LED light with built-in TRÅDFRI remote control in order to extract the Zigbee module according to the description by ehsmaes on Instructables. But it wasn’t before a couple of minutes ago that I actually desoldered the Zigbee board and connected it to an LED on a breadboard for further experiments:

IKEA TRÅDFRI Zigbee module on a breadboard.

PWM internals

Since this is a dimable LED it supports setting brightness values between 0 and 100 using the CoAP interface unlike the other receivers which I have been using so far and which are switched wall socket adapters. But how do these brightness values translate into the corresponding duty cycles of the output pwm-signal of the Zigbee module – and what are the general parameters of this output, anyway?

PWM signal at the output of the Zigbee module.

I don’t feel the need right now to dig deeper into the firmware of the Zigbee module, since it is enough for me to perhaps repurpose some of these modules out of legit GU10 TRÅDFRI lamps (the cheapest item of the series), but if I wanted to, I would start at basilfx GIT repository. The actual layout of the module has been hacked by Mikael Sundin:

The pinout of the TRÅDFRI module -as reverse engineered by Mikael Sundin.

OK, so what are the parameters of the pwm-signal now?

As you can see it is quite a non-linear scale – as expected for a smoothly dimming light source due to the non-linearity of our eyes.

Relation between the set brightness value using CoAP and the PWM duty cycle.