diff --git a/README.md b/README.md
index 69ebe84c4..3a33869bf 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 ## Sonoff-Tasmota
 Provide ESP8266 based Sonoff by [iTead Studio](https://www.itead.cc/) and ElectroDragon IoT Relay with Serial, Web and MQTT control allowing 'Over the Air' or OTA firmware updates using Arduino IDE.
 
-Current version is **5.2.1** - See [sonoff/_releasenotes.ino](https://github.com/arendst/Sonoff-Tasmota/blob/master/sonoff/_releasenotes.ino) for change information.
+Current version is **5.2.2** - See [sonoff/_releasenotes.ino](https://github.com/arendst/Sonoff-Tasmota/blob/master/sonoff/_releasenotes.ino) for change information.
 
 ### **** ATTENTION Version 5.x.x specific information ****
 
diff --git a/sonoff/_releasenotes.ino b/sonoff/_releasenotes.ino
index 6e7c741b6..2d095538e 100644
--- a/sonoff/_releasenotes.ino
+++ b/sonoff/_releasenotes.ino
@@ -1,4 +1,10 @@
-/* 5.2.1 20170622
+/* 5.2.2 20170625
+ * Add configuration SaveAddress to Status 1 and Information Page
+ * Change Sonoff Led Color conversion from AtoH to strtol
+ * Fix possible wrong uploads due to configuration overwrites (#542)
+ * Fix payload negative numbers (#547)
+ *
+ * 5.2.1 20170622
  * Fix Restore Configuration in case of lower version
  * Revert auto configuration upgrade allowing easy upgrade which was removed in version 5.2.0 
  * Fix config auto upgrade from versions below version 4.1.1 (#530)
diff --git a/sonoff/settings.ino b/sonoff/settings.ino
index 81094cb8d..9149a7ccc 100644
--- a/sonoff/settings.ino
+++ b/sonoff/settings.ino
@@ -195,22 +195,26 @@ uint32_t getHash()
  * Config Save - Save parameters to Flash ONLY if any parameter has changed
 \*********************************************************************************************/
 
-void CFG_Save(byte force)
+uint32_t CFG_Address()
+{
+  return _cfgLocation * SPI_FLASH_SEC_SIZE;
+}
+
+void CFG_Save(byte no_rotate)
 {
   char log[LOGSZ];
 
 #ifndef BE_MINIMAL
-  if ((getHash() != _cfgHash) || force) {
-    if (sysCfg.flag.stop_flash_rotate) {
+  if ((getHash() != _cfgHash) || no_rotate) {
+    if (no_rotate) {
+      stop_flash_rotate = 1;  // Disable flash rotate from now on
+    }
+    if (stop_flash_rotate) {
       _cfgLocation = CFG_LOCATION;
     } else {
-      if (force) {
+      _cfgLocation--;
+      if (_cfgLocation <= (CFG_LOCATION - CFG_ROTATES)) {
         _cfgLocation = CFG_LOCATION;
-      } else {
-        _cfgLocation--;
-        if (_cfgLocation <= (CFG_LOCATION - CFG_ROTATES)) {
-          _cfgLocation = CFG_LOCATION;
-        }
       }
     }
     sysCfg.saveFlag++;
@@ -218,7 +222,7 @@ void CFG_Save(byte force)
     spi_flash_erase_sector(_cfgLocation);
     spi_flash_write(_cfgLocation * SPI_FLASH_SEC_SIZE, (uint32*)&sysCfg, sizeof(SYSCFG));
     interrupts();
-    if (!sysCfg.flag.stop_flash_rotate && force) {
+    if (!stop_flash_rotate && no_rotate) {
       for (byte i = 1; i < CFG_ROTATES; i++) {
         noInterrupts();
         spi_flash_erase_sector(_cfgLocation -i);  // Delete previous configurations by resetting to 0xFF
@@ -226,7 +230,7 @@ void CFG_Save(byte force)
         delay(1);
       }
     }
-    snprintf_P(log, sizeof(log), PSTR("Cnfg: %s (%d bytes) to flash at %X and count %d"), (force) ? "Backup" : "Save", sizeof(SYSCFG), _cfgLocation, sysCfg.saveFlag);
+    snprintf_P(log, sizeof(log), PSTR("Cnfg: Save (%d bytes) to flash at %X and count %d"), sizeof(SYSCFG), _cfgLocation, sysCfg.saveFlag);
     addLog(LOG_LEVEL_DEBUG, log);
     _cfgHash = getHash();
   }
diff --git a/sonoff/sonoff.ino b/sonoff/sonoff.ino
index 2c4a43ff9..6780dbb48 100644
--- a/sonoff/sonoff.ino
+++ b/sonoff/sonoff.ino
@@ -24,7 +24,7 @@
     - Select IDE Tools - Flash size: "1M (no SPIFFS)"
   ====================================================*/
 
-#define VERSION                0x05020100  // 5.2.1
+#define VERSION                0x05020200  // 5.2.2
 
 enum log_t   {LOG_LEVEL_NONE, LOG_LEVEL_ERROR, LOG_LEVEL_INFO, LOG_LEVEL_DEBUG, LOG_LEVEL_DEBUG_MORE, LOG_LEVEL_ALL};
 enum week_t  {Last, First, Second, Third, Fourth};
@@ -270,6 +270,7 @@ uint16_t syslog_timer = 0;            // Timer to re-enable syslog_level
 byte seriallog_level;                 // Current copy of sysCfg.seriallog_level
 uint16_t seriallog_timer = 0;         // Timer to disable Seriallog
 uint8_t sleep;                        // Current copy of sysCfg.sleep
+uint8_t stop_flash_rotate = 0;        // Allow flash configuration rotation
 
 int blinks = 201;                     // Number of LED blinks
 uint8_t blinkstate = 0;               // LED state
@@ -915,11 +916,13 @@ void mqttDataCb(char* topic, byte* data, unsigned int data_len)
     if (!strcmp(dataBufUc,"?")) {
       data_len = 0;
     }
-    int16_t payload = -1;                // No payload
-    if (data_len && isdigit(dataBuf[0])) {
-      payload = atoi(dataBuf);           // -32766 - 32767
+    int16_t payload = -99;               // No payload
+    uint16_t payload16 = 0;
+    long lnum = strtol(dataBuf, &p, 10);
+    if (p != dataBuf) {
+      payload = (int16_t) lnum;          // -32766 - 32767
+      payload16 = (uint16_t) lnum;       // 0 - 65535
     }
-    uint16_t payload16 = atoi(dataBuf);  // 0 - 65535
 
     if (!strcmp_P(dataBufUc,PSTR("OFF")) || !strcmp_P(dataBufUc,PSTR("FALSE")) || !strcmp_P(dataBufUc,PSTR("STOP")) || !strcmp_P(dataBufUc,PSTR("CELSIUS"))) {
       payload = 0;
@@ -937,8 +940,8 @@ void mqttDataCb(char* topic, byte* data, unsigned int data_len)
       payload = 4;
     }
 
-//    snprintf_P(svalue, sizeof(svalue), PSTR("RSLT: Payload %d, Payload16 %d"), payload, payload16);
-//    addLog(LOG_LEVEL_DEBUG, svalue);
+    snprintf_P(svalue, sizeof(svalue), PSTR("RSLT: Payload %d, Payload16 %d"), payload, payload16);
+    addLog(LOG_LEVEL_DEBUG, svalue);
 
     if (!strcmp_P(type,PSTR("POWER")) && (index > 0) && (index <= Maxdevice)) {
       if ((payload < 0) || (payload > 4)) {
@@ -1030,8 +1033,9 @@ void mqttDataCb(char* topic, byte* data, unsigned int data_len)
               case 12:  // stop_flash_rotate
                 bitWrite(sysCfg.flag.data, index, payload);
             }
-            if (12 == index) {
-              CFG_Save(1);
+            if (12 == index) {  // stop_flash_rotate
+              stop_flash_rotate = payload;
+              CFG_Save(stop_flash_rotate);
             }
           }
         }
@@ -1735,8 +1739,8 @@ void publish_status(uint8_t payload)
   }
 
   if ((0 == payload) || (1 == payload)) {
-    snprintf_P(svalue, sizeof(svalue), PSTR("{\"StatusPRM\":{\"Baudrate\":%d, \"GroupTopic\":\"%s\", \"OtaUrl\":\"%s\", \"Uptime\":%d, \"Sleep\":%d, \"BootCount\":%d, \"SaveCount\":%d}}"),
-      Baudrate, sysCfg.mqtt_grptopic, sysCfg.otaUrl, uptime, sysCfg.sleep, sysCfg.bootcount, sysCfg.saveFlag);
+    snprintf_P(svalue, sizeof(svalue), PSTR("{\"StatusPRM\":{\"Baudrate\":%d, \"GroupTopic\":\"%s\", \"OtaUrl\":\"%s\", \"Uptime\":%d, \"Sleep\":%d, \"BootCount\":%d, \"SaveCount\":%d, \"SaveAddress\":\"%X\"}}"),
+      Baudrate, sysCfg.mqtt_grptopic, sysCfg.otaUrl, uptime, sysCfg.sleep, sysCfg.bootcount, sysCfg.saveFlag, CFG_Address());
     mqtt_publish_topic_P(option, PSTR("STATUS1"), svalue);
   }
 
@@ -2621,6 +2625,7 @@ void setup()
   sysCfg.bootcount++;
   snprintf_P(log, sizeof(log), PSTR("APP: Bootcount %d"), sysCfg.bootcount);
   addLog(LOG_LEVEL_DEBUG, log);
+  stop_flash_rotate = sysCfg.flag.stop_flash_rotate;
   savedatacounter = sysCfg.savedata;
   seriallog_timer = SERIALLOG_TIMER;
   seriallog_level = sysCfg.seriallog_level;
diff --git a/sonoff/webserver.ino b/sonoff/webserver.ino
index 26a8a692f..79d94de39 100644
--- a/sonoff/webserver.ino
+++ b/sonoff/webserver.ino
@@ -1144,6 +1144,7 @@ void handleUploadDone()
     page += error;
     snprintf_P(log, sizeof(log), PSTR("Upload: %s"), error);
     addLog(LOG_LEVEL_DEBUG, log);
+    stop_flash_rotate = sysCfg.flag.stop_flash_rotate;
   } else {
     page += F("<font color='green'>successful</font></b><br/><br/>Device will restart in a few seconds");
     restartflag = 2;
@@ -1232,10 +1233,7 @@ void handleUploadLoop()
         }
         CFG_DefaultSet2();
         memcpy((char*)&sysCfg +16, upload.buf +16, upload.currentSize -16);
-        
         memcpy((char*)&sysCfg +8, upload.buf +8, 4);  // Restore version and auto upgrade
-//        CFG_Delta();
-        
       }
     } else {  // firmware
       if (!_uploaderror && (Update.write(upload.buf, upload.currentSize) != upload.currentSize)) {
@@ -1431,7 +1429,8 @@ void handleInfo()
   page += F("<tr><th>Core/SDK version</th><td>"); page += ESP.getCoreVersion(); page += F("/"); page += String(ESP.getSdkVersion()); page += F("</td></tr>");
 //  page += F("<tr><th>Boot version</th><td>"); page += String(ESP.getBootVersion()); page += F("</td></tr>");
   page += F("<tr><th>Uptime</th><td>"); page += String(uptime); page += F(" Hours</td></tr>");
-  page += F("<tr><th>Flash write count</th><td>"); page += String(sysCfg.saveFlag); page += F("</td></tr>");
+  snprintf_P(stopic, sizeof(stopic), PSTR(" at %X"), CFG_Address());
+  page += F("<tr><th>Flash write count</th><td>"); page += String(sysCfg.saveFlag); page += stopic; page += F("</td></tr>");
   page += F("<tr><th>Boot count</th><td>"); page += String(sysCfg.bootcount); page += F("</td></tr>");
   page += F("<tr><th>Reset reason</th><td>"); page += getResetReason(); page += F("</td></tr>");
   for (byte i = 0; i < Maxdevice; i++) {
diff --git a/sonoff/xdrv_snfled.ino b/sonoff/xdrv_snfled.ino
index 1d8eea980..ff098dfee 100644
--- a/sonoff/xdrv_snfled.ino
+++ b/sonoff/xdrv_snfled.ino
@@ -49,30 +49,6 @@ uint8_t sl_wakeupActive = 0;
 uint8_t sl_wakeupDimmer = 0;
 uint16_t sl_wakeupCntr = 0;
 
-uint32_t Atoh(char *s)
-{
-  uint32_t value = 0;
-  uint32_t digit;
-  int8_t c;
-  
-  while((c = *s++)) {
-    if ('0' <= c && c <= '9') {
-      digit = c - '0';
-    }
-    else if ('A' <= c && c <= 'F') {
-      digit = c - 'A' + 10;
-    }
-    else if ('a' <= c && c <= 'f') {
-      digit = c - 'a' + 10;
-    }
-    else {
-      break;
-    }
-    value = (value << 4) | digit;
-  }
-  return value;
-}
-
 void sl_setDim(uint8_t myDimmer)
 {
   float newDim = 100 / (float)myDimmer;
@@ -176,6 +152,7 @@ boolean sl_command(char *type, uint16_t index, char *dataBufUc, uint16_t data_le
 {
   boolean serviced = true;
   boolean coldim = false;
+  char *p;
 
   if (!strcmp_P(type,PSTR("COLOR"))) {
     uint8_t my_color[5];
@@ -185,8 +162,8 @@ boolean sl_command(char *type, uint16_t index, char *dataBufUc, uint16_t data_le
       ccold[2] = '\0';
       memcpy(cwarm, dataBufUc + 2, 2);
       cwarm[2] = '\0';
-      my_color[0] = Atoh(ccold);
-      my_color[1] = Atoh(cwarm);
+      my_color[0] = strtol(ccold, &p, 16);
+      my_color[1] = strtol(cwarm, &p, 16);
       uint16_t temp = my_color[0];
       if (temp < my_color[1]) {
         temp = my_color[1];