Review, Teardown: Belkin WeMo Switch (F7C027au)

All of this home automation stuff is admittedly a little addictive – being the curious type, I’ve always wanted to see how far these things can go. As a result, in addition to buying the Belkin WeMo globes at a discount, I also decided to pick up a Belkin WeMo Switch. It was a little pricey at AU$61.20 shipped on discount, but that’s exactly the sort of premium you expect to pay for smart devices.

The Belkin WeMo system is a well-established line of wirelessly connected products that supposedly make your life easier. These include lighting, motion sensors, switches, cameras, baby monitors, and more. While the lighting system utilizes a Wi-Fi to Zigbee hub similarly to the OSRAM LIGHTIFY system, the rest of the WeMo ecosystem is Wi-Fi based and a seamless “integrated” appearance is provided by the WeMo app and the way the products are configured to be able to talk to one another.

Lets take a look at the Belkin WeMo Switch – my entry point into the WeMo ecosystem.

Unboxing

20151201-1638-0422 20151201-1638-0421

The WeMo Switch comes in a matte finish colour cardboard box with a plastic hanger, styled in a lime-green and white colour scheme as used by the WeMo ecosystem. The bottom of the box gives the full specs, of which there are few – namely that it can control up to 10A/2400W, has one outlet, and uses 2.4Ghz 802.11n. It comes with a 1-year limited warranty.

20151201-1637-0417 20151201-1637-0418

So what is a WeMo Switch? It’s basically a box that plugs in-between a GPO and a device, which allows you to then turn on and off the device under control of the WeMo app. This allows older devices (e.g. fans, desk lamps) to be controlled remotely, or on a schedule.

20151201-1637-0419 20151201-1637-0420The sides of the box gives you a few ideas of what is possible and some of the other products in the WeMo family.

The WeMo system also boasts compatibility with IFTTT (If This Then That) which is an cloud automation platform which allows you to receive events and perform actions based on those events. It is hence, possible, to make lights which turn on when someone tweets something to a particular account, for example.

20151201-1639-0423

When the box is opened, there is an inner cardboard box which slides out. This box hinges open to reveal a covering card, which itself, is a single sided quick-start guide, along with a small leaflet nestled within with regulatory information.

20151201-1640-0424

Aside from that, you obviously get the switch unit itself.

20151201-1640-0425

Unfortunately, from a practicality perspective, this unit fails at practically everything. The unit is somewhat big, and has significant overhang left and right of the socket, resulting in it covering the adjacent power points on both sides. The unit also extends upwards, making it difficult to access the hardware power switch on a wallplate as well. It would be nice if they could make it quite a bit more compact, or maybe make it into a “lead with a box” as this is just begging to be plugged into an extension lead.

One good thing is that there is a manual power on/off toggle button on the body which allows you to immediately override the state of the switch without having a mobile device on you.

20151201-1641-0426

20151201-1641-0427A restore button is provided on the top of the unit to reset the device to factory defaults, and the front fascia and the rear has a “vented” gap across the whole device to allow for ventilation of the internal electronics.

The rear has the plug which goes into your wall, as well as all the information about the device. This includes the Wi-Fi SSID, although during set-up, the SSID is not password protected meaning that the device is briefly vulnerable to being set-up by someone else after a factory reset.

Now it’s time to set it up …

Setting Up & the WeMo App

wemo-logoThe first step to setting up is to install the WeMo app and to have the device plugged into power. The app is easy to find on both platforms, although is only really made with phone screens in mind. After opening the app for the first time, you will be taken to a screen where you can see the set-up instructions. Following them, you can set up the device.

wemo-setup

As the animated GIF above shows, the process involves connecting to the unsecured Wi-Fi AP broadcast by an unconfigured WeMo device, inputting the Wi-Fi credentials, waiting for it to connect and set-up remote access, and then customizing the name of the device. Once this is done, then the device is ready to use.

But Wait … There’s More!

fw-updavailActually, what I said is what’s supposed to happen in an ideal world, but alas, there is one wrinkle. Firmware updates.

Despite my device being relatively recent, a firmware update was available and visible straight after setting up the device. Proceeding with the update, you are prompted with a wait screen that tells you that updates can take about 10 minutes, fw-upgnotesbut is handled by the device independently, so you don’t necessarily need to attend it.

fwupd-inprog

In theory, the update results in a blinking LED on the device which stops blinking as the update completes and the WeMo app will tell you that it’s successful. Sadly, after half an hour, the thing wasn’t complete and instead was blinking orange. It wasn’t on the network anymore! Have I bricked it already?

Even after a power cycle, it wasn’t possible to get it to reconnect to the configured network, and it didn’t broadcast its own network either. It was only after a factory reset and running through the whole set-up process again that the device was recovered and the firmware was updated. Such a process can get tedious very quickly, and can induce a lot of support headaches and anxiety in new users – it really shouldn’t be like this.

A Tour Through the App

wemo-main-screenThe app is a little slow to start up, as it waits for the broadcast announcements from WeMo devices to discover what is on the network. It’s sometimes a little laggy during set-up and going through settings screens as well, but otherwise, is generally well behaved. When opened, it shows the devices screen.

The top toolbar has buttons which allow you to rescan the network. The edit button allows you to edit the devices and their ordering. The cog icon allows you to access the settings. The lower toolbar allows you to switch to the rules menu.

wemo-customized-picturename

An example of customization of the devices is given above, where I changed the WeMo Switch to show a photograph of the unit being controlled (taken by the phone) with a customized name. This seems to be stored on the switch, which allows other people who have WeMo app installed on the same network to see the same customized name without manual reconfiguration.

wemo-control-automate wemo-timermode

The WeMo Rules page shows just how integrated and powerful the WeMo platform is. It is possible to set timed schedules, or by sunrise/sunset times, as well as auto-off timers, motion sensor linked control (requires the motion accessory). Such schedules are capable of operation directly without internet connection it seems, as local devices can talk to one-another over the network. With a basic timed rule, it’s possible to set individual start and stop times for maximum flexibility.

wemo-sunriseset wemo-auto-off-timer

wemo-awaymodeIf you select the sunset/sunrise option, a different menu appears which requests your location to determine the times. The timer-off feature is quite easy to configure as well, and allows for easy one-push “timed” operation, which is nifty.

Away mode is also provided to set a “scene” for all your devices when away mode is toggled on.

Notifications can also be done with motion or with sensed power events from the Insight switch.

It’s pretty clear that the WeMo has the upper hand when it comes to schedule flexibility and complexity compared to the LIGHTIFY system, however, to take maximum advantage of the options, other accessories may be necessary.

Another major part of the app is the settings menu.

wemo-settings wemo-settingsabout

wemo-iftt-linkThe WeMo settings menu is relatively sparse. It allows you to toggle on and off the remote access abilities. The Settings and About menu gives you the option to forget the stored Wi-Fi settings for fast provisioning of new devices, set the location (used for sunrise and sunset calculations) and see the app version and firmware versions of the devices.

wemo-fwversion

The final feature is to generate an IFTTT PIN so that you can connect with IFTTT. As I’m not an IFTTT user, I didn’t try it, but apparently it’s quite flexible.

Electrical Performance

Given that it’s a relatively simple switching device, there really isn’t much to say about its electrical performance. It clicks nicely when it turns on and off, a clear sign that the switching is performed by a physical relay, which should be able to handle decent loads in a robust manner. I did check what happens when there is a power outage, and sadly, the device defaults to returning in a power-off state which is safe, but is also not necessarily preferable if using it as a remote power cycling device.

I suppose the main interest from an electrical standpoint is the standby energy cost. Again, the Tektronix PA1000 along with my pure sine-wave inverter and variac come to the rescue, and it was determined (to IEC standards) that the Belkin WeMo Switch consumes 1.1903W when the output is off, and 1.6458W when the output is on (additional power due to power consumed by the relay coil). This seems to be slightly variable depending on the background broadcast Wi-Fi traffic, but it amounts to about 10.4kWh/year consumed in the off state, which is about AU$2.61/year assuming an electricity price of $0.25/kWh. This, again, is the price of convenience – but to put this into perspective, a modern mobile phone charger consumes 0.05-0.1W in standby, so if you think you’ll be saving energy with a WeMo Switch, you will need to seriously reconsider.

On the Network

The Belkin WeMo switch connects to the network configured during set-up and automatically configures itself, and grabs an address via DHCP. It is not compatible with corporate Wi-Fi networks and those with captive portals. It uses several ports as noted in Belkin’s own documentation:

wemo-ports

It’s clear that it uses uPnP for advertisement and discovery, and another port for actually dealing with requests – the uPnP announces look like the following:

NOTIFY * HTTP/1.1
HOST: 239.255.255.250:1900
CACHE-CONTROL: max-age=86400
LOCATION: http://[LOCAL-IP]:49153/setup.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 82951ac8-1dd2-11b2-9882-c3f22b733d10
NT: upnp:rootdevice
NTS: ssdp:alive
SERVER: Unspecified, UPnP/1.0, Unspecified
X-User-Agent: redsonic
USN: uuid:Socket-1_0-[SERIAL-ID]::upnp:rootdevice

NOTIFY * HTTP/1.1
HOST: 239.255.255.250:1900
CACHE-CONTROL: max-age=86400
LOCATION: http://[LOCAL-IP]:49153/setup.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 82951ac8-1dd2-11b2-9882-c3f22b733d10
NT: uuid:Socket-1_0-[SERIAL-ID]
NTS: ssdp:alive
SERVER: Unspecified, UPnP/1.0, Unspecified
X-User-Agent: redsonic
USN: uuid:Socket-1_0-[SERIAL-ID]

NOTIFY * HTTP/1.1
HOST: 239.255.255.250:1900
CACHE-CONTROL: max-age=86400
LOCATION: http://[LOCAL-IP]:49153/setup.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 82951ac8-1dd2-11b2-9882-c3f22b733d10
NT: urn:Belkin:device:controllee:1
NTS: ssdp:alive
SERVER: Unspecified, UPnP/1.0, Unspecified
X-User-Agent: redsonic
USN: uuid:Socket-1_0-[SERIAL-ID]::urn:Belkin:device:controllee:1

NOTIFY * HTTP/1.1
HOST: 239.255.255.250:1900
CACHE-CONTROL: max-age=86400
LOCATION: http://[LOCAL-IP]:49153/setup.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 82951ac8-1dd2-11b2-9882-c3f22b733d10
NT: urn:Belkin:service:WiFiSetup:1
NTS: ssdp:alive
SERVER: Unspecified, UPnP/1.0, Unspecified
X-User-Agent: redsonic
USN: uuid:Socket-1_0-[SERIAL-ID]::urn:Belkin:service:WiFiSetup:1

NOTIFY * HTTP/1.1
HOST: 239.255.255.250:1900
CACHE-CONTROL: max-age=86400
LOCATION: http://[LOCAL-IP]:49153/setup.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 82951ac8-1dd2-11b2-9882-c3f22b733d10
NT: urn:Belkin:service:timesync:1
NTS: ssdp:alive
SERVER: Unspecified, UPnP/1.0, Unspecified
X-User-Agent: redsonic
USN: uuid:Socket-1_0-[SERIAL-ID]::urn:Belkin:service:timesync:1

NOTIFY * HTTP/1.1
HOST: 239.255.255.250:1900
CACHE-CONTROL: max-age=86400
LOCATION: http://[LOCAL-IP]:49153/setup.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 82951ac8-1dd2-11b2-9882-c3f22b733d10
NT: urn:Belkin:service:basicevent:1
NTS: ssdp:alive
SERVER: Unspecified, UPnP/1.0, Unspecified
X-User-Agent: redsonic
USN: uuid:Socket-1_0-[SERIAL-ID]::urn:Belkin:service:basicevent:1

NOTIFY * HTTP/1.1
HOST: 239.255.255.250:1900
CACHE-CONTROL: max-age=86400
LOCATION: http://[LOCAL-IP]:49153/setup.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 82951ac8-1dd2-11b2-9882-c3f22b733d10
NT: urn:Belkin:service:firmwareupdate:1
NTS: ssdp:alive
SERVER: Unspecified, UPnP/1.0, Unspecified
X-User-Agent: redsonic
USN: uuid:Socket-1_0-[SERIAL-ID]::urn:Belkin:service:firmwareupdate:1

NOTIFY * HTTP/1.1
HOST: 239.255.255.250:1900
CACHE-CONTROL: max-age=86400
LOCATION: http://[LOCAL-IP]:49153/setup.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 82951ac8-1dd2-11b2-9882-c3f22b733d10
NT: urn:Belkin:service:rules:1
NTS: ssdp:alive
SERVER: Unspecified, UPnP/1.0, Unspecified
X-User-Agent: redsonic
USN: uuid:Socket-1_0-[SERIAL-ID]::urn:Belkin:service:rules:1

NOTIFY * HTTP/1.1
HOST: 239.255.255.250:1900
CACHE-CONTROL: max-age=86400
LOCATION: http://[LOCAL-IP]:49153/setup.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 82951ac8-1dd2-11b2-9882-c3f22b733d10
NT: urn:Belkin:service:metainfo:1
NTS: ssdp:alive
SERVER: Unspecified, UPnP/1.0, Unspecified
X-User-Agent: redsonic
USN: uuid:Socket-1_0-[SERIAL-ID]::urn:Belkin:service:metainfo:1

NOTIFY * HTTP/1.1
HOST: 239.255.255.250:1900
CACHE-CONTROL: max-age=86400
LOCATION: http://[LOCAL-IP]:49153/setup.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 82951ac8-1dd2-11b2-9882-c3f22b733d10
NT: urn:Belkin:service:remoteaccess:1
NTS: ssdp:alive
SERVER: Unspecified, UPnP/1.0, Unspecified
X-User-Agent: redsonic
USN: uuid:Socket-1_0-[SERIAL-ID]::urn:Belkin:service:remoteaccess:1

NOTIFY * HTTP/1.1
HOST: 239.255.255.250:1900
CACHE-CONTROL: max-age=86400
LOCATION: http://[LOCAL-IP]:49153/setup.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 82951ac8-1dd2-11b2-9882-c3f22b733d10
NT: urn:Belkin:service:deviceinfo:1
NTS: ssdp:alive
SERVER: Unspecified, UPnP/1.0, Unspecified
X-User-Agent: redsonic
USN: uuid:Socket-1_0-[SERIAL-ID]::urn:Belkin:service:deviceinfo:1

NOTIFY * HTTP/1.1
HOST: 239.255.255.250:1900
CACHE-CONTROL: max-age=86400
LOCATION: http://[LOCAL-IP]:49153/setup.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 82951ac8-1dd2-11b2-9882-c3f22b733d10
NT: urn:Belkin:service:smartsetup:1
NTS: ssdp:alive
SERVER: Unspecified, UPnP/1.0, Unspecified
X-User-Agent: redsonic
USN: uuid:Socket-1_0-[SERIAL-ID]::urn:Belkin:service:smartsetup:1

NOTIFY * HTTP/1.1
HOST: 239.255.255.250:1900
CACHE-CONTROL: max-age=86400
LOCATION: http://[LOCAL-IP]:49153/setup.xml
OPT: "http://schemas.upnp.org/upnp/1/0/"; ns=01
01-NLS: 82951ac8-1dd2-11b2-9882-c3f22b733d10
NT: urn:Belkin:service:manufacture:1
NTS: ssdp:alive
SERVER: Unspecified, UPnP/1.0, Unspecified
X-User-Agent: redsonic
USN: uuid:Socket-1_0-[SERIAL-ID]::urn:Belkin:service:manufacture:1

Each WeMo device likely sends its own batches of uPnP announcements, so it’s clear how the network can get somewhat chatty with so many broadcasts floating around. It’s also clear that there is no security as such, so if the network itself is compromised, it is possible to wreak havoc with it. This goes for most home automation devices at this stage, however.

It is rather nifty, however, that the Belkin WeMo products can be easily commanded by using a shell script that invokes cURL and this makes various control tasks a lot easier than otherwise.

Further zenmap probing seems to show the unit also has an open DNS port which forwards all requests upstream. The reason it is open on the device is unclear, and seems to be an oversight.

wemo-portscan

Teardown

As usual, I was curious to find out what was inside, and what was powering the WeMo Switch. The first obstacle to tearing it down was the use of triangle screws, with two of them hidden behind the label. Luckily, I had the appropriate bit lying around …

20151201-1642-0428

Once opened, there is a front panel PCB and a rear PCB connected by a short piece of cable which needs to be disconnected to separate the two halves. The front part is the main smarts of the device.

20151201-1646-0429

We can see a Ralink RT5350F chipset, with a 360 MHz MIPS24KEc core, more often used for Wireless Routers being repurposed for this application. The connecting cable while using a 5-pin connector only has three pins connected – likely a positive, ground and GPIO output used to control the other board’s switch. A single printed trace antenna is seen on the PCB, as well as an outline for a shielding can which was not installed. The PCB is dated Week 2 of 2015.

20151201-1647-0430

The rear of the PCB has an ESMT M12L2561616A 32MiB SDRAM (Week 49, 2014), and Macronix MX25L12835FM1 16MiB SPI Flash.

20151201-1648-0431

The other board houses the high voltage switching and low voltage power supply circuitry. It seems to be branded Atech OEM A005105-FA1. Switching is achieved with a Hongfa HF3FA relay cube rated at 10A/250VAC. The internal power supply is fused at 1A.

20151201-1649-0434

Interestingly, it seems overload protection is provided by some sort of variable resistor/thermistor coupled by tape to a thermal fuse rated at 130 degrees C.

20151201-1649-0435 20151201-1649-0433

A look at the capacitors seems to be relatively uninspiring, with a pair of Taicons and a unknown Foai branded capacitor.

20151201-1651-0437

The rear of the board seems to show a surface mounted bridge rectifier and a switchmode power supply controller (LNK606D6 Linkswitch II) and is dated Week 49 of 2014.

20151201-1651-0436

The incoming power plug has wires soldered directly to the pins which seems a little odd and could pose a bit of a risk in high current applications as if heat builds up, the solder could liquefy. I would have expected more reliable crimp connections be used instead, but it’s still probably quite sufficient.

Conclusion

The Belkin WeMo system has existed for longer than the OSRAM LIGHTIFY system and so has more accessories available in the Australian market. Some of these accessories, such as the power-sensing Insight switch, and the Motion Sensor make for control possibilities which are not available in other systems. WeMo’s integration with IFTTT along with more sophisticated scheduling possibilities (sun down/auto-off timer) provides much better flexibility.

Most of the system is reliant on Wi-Fi, and single-banded 2.4Ghz Wi-Fi. This can pose problems with overloaded access points/DHCP servers if you start going crazy installing many WeMo products and result in unreliable operation when under interference from microwave ovens.

As the system operates on a local uPnP discovery basis, there is no need for setting up an account and signing into it from other devices. As soon as the app is installed and opened, it can discover all the WeMo devices on the network automatically and command them directly. Despite the often claimed problems with setting up remote access, I didn’t experience any issues.

Despite this, there are annoyances with the WeMo system. One major gripe is the slowness of the app itself, as it has to start up and wait for the broadcasts to discover the devices. Some third party developers have tried to capitalize on this by issuing paid for apps which have memory of where devices are on the network to overcome this, but it shouldn’t be necessary. Working with the app was also slower than expected at times, with noticeable lag in calling up settings pages. Worst of all was the problematic firmware upgrade process which left me needing to reconfigure the switch immediately after it was first set up.

Despite the fact the system isn’t actually documented, due to the work of others in reverse engineering the simple uPnP protocol, the system is easy to command from any computer on the local network. However, just like other systems, has no real “security” on the local network which allows any networked computer on the same network to interfere and command the devices. Therefore, it is paramount that the local network be kept as secure as possible.

On the whole, I’ve found the Belkin WeMo Switch to do what it says on the box and fairly reliably at that. The ease at which it can be adapted for control from something as simple as a shell script can make it an enticing proposition for remotely power cycling or controlling appliances despite the price tag and would allow you to integrate “dumb” appliances into an app-controlled system provided they run when power is applied and are safely shut down on removal of power.

About lui_gough

I’m a bit of a nut for electronics, computing, photography, radio, satellite and other technical hobbies. Click for more about me!

This entry was posted in Electronics, Lighting and tagged , , , , , , , , , . Bookmark the permalink.

Error: Comment is Missing!