Popping the case open reveals the spartan interior:
Not much to mention here, we have a PIR sensor, a PIR dedicated chip, and a radio module.
The PIR chip is an Elmos E931.96 IC with two signals: Interrupt/Serial Out and Serial In.
So far this looks extremely hackable. I could easily replace the module with my own header, plug this into an arduino or raspberry pi and call it a day. I don't think that's enough though, I want to see if I can break into the module.
I stumbled upon this looking for an alternative firmware for this (old style, P/N 303.835.11) IKEA TRÅDFRI motion sensor (which I bought second hand because it offers the possibility to control the period of time the controlled device is enabled for upon motion detection, as opposed to the newer model) or its successor.
So, obviously I was unsatisfied with the new model (P/N 704.299.13), although I find its motion detection capabilities by far superior (it is equipped with a much bigger lens). Plus, the new model is designed to run off a single CR2032, which seems much more convenient. It seems that IKEA has reacted to customers issues to extend batery life since the initial firmware - so one could try running the old sensor with the latest firmware off a single cell and see how long that lasts.
You might find this description of the Elmos E931.96 useful http://www.mos.co.za/downloads/e93196/e93196.pdf, especially the part on serial communication.
I wonder if different firmware versions program the E931.96 differently. ZHA reports 0x12214572 (apparently 1.2.214) for mine btw, which I think is quite old (2.0.022 seems to be the latest atm) I can not update it atm since I gave my TRÅDFRI gateway away. Based on the documet mentioned above, some parameters impacting detection quality are externally available (and even a temperature signal).
Bas has an interesting collection of projects around the TRÅDFRI modules: https://github.com/basilfx/TRADFRI-Hacking.
Hello Connor,
Nice work, thanks!
I stumbled upon this looking for an alternative firmware for this (old style, P/N 303.835.11) IKEA TRÅDFRI motion sensor (which I bought second hand because it offers the possibility to control the period of time the controlled device is enabled for upon motion detection, as opposed to the newer model) or its successor.
So, obviously I was unsatisfied with the new model (P/N 704.299.13), although I find its motion detection capabilities by far superior (it is equipped with a much bigger lens). Plus, the new model is designed to run off a single CR2032, which seems much more convenient. It seems that IKEA has reacted to customers issues to extend batery life since the initial firmware - so one could try running the old sensor with the latest firmware off a single cell and see how long that lasts.
You might find this description of the Elmos E931.96 useful http://www.mos.co.za/downloads/e93196/e93196.pdf, especially the part on serial communication.
I wonder if different firmware versions program the E931.96 differently. ZHA reports 0x12214572 (apparently 1.2.214) for mine btw, which I think is quite old (2.0.022 seems to be the latest atm) I can not update it atm since I gave my TRÅDFRI gateway away. Based on the documet mentioned above, some parameters impacting detection quality are externally available (and even a temperature signal).
Bas has an interesting collection of projects around the TRÅDFRI modules: https://github.com/basilfx/TRADFRI-Hacking.
Cheers
Peter