search

pvvx / BLE_THSensor

BLE temperature and humidity sensor based on TS0201, TH03Z, ZTH01, ZTH02
Other
22 stars 5 forks source link

Zigbee: TS0201 by _TZ3000_xr3htd96 #7

Closed robvanoostenrijk closed 4 months ago

robvanoostenrijk commented 5 months ago

I have a TS0201 by _TZ3000_xr3htd96, which is already Zigbee and reports the following OTA data:

Manufacturer ID: 4417 (0x1141) Image Type: 54179 (0xD3A3) Image Version: 70 (0x46)

Is there any method to use Zigbee OTA to convert this to an optimal pvvx zigbee firmware (1141-0211-01183001-ZTS0201Z3000.zigbee)?

Or is the only way to flash these from factory, with a wired USB-TTL programmer?

pvvx commented 5 months ago

https://pvvx.github.io/TS0201_TZ3000/ uses an additional bootloader. Has a different firmware format. Orig.FullFlash bin

Simply changing the IDs won't help. A special version needs to be created.

One of these days I'll see what I can do...

pvvx commented 5 months ago

The created OTA from FullFlash works. Original Tuya OTA ver 70 I installed version 71. It loaded:

41:21.321 DEBUG OTA query_next_image handler for '_TZ3000_xr3htd96 TS0201': field_control=0, manufacturer_id=4417, image_type=54179, current_file_version=70, hardware_version=None, model='TS0201'
41:21.396 INFO  Updating: _TZ3000_xr3htd96 TS0201
41:21.397 DEBUG Sending reply: query_next_image_response(status=<Status.SUCCESS: 0>, manufacturer_code=4417, image_type=54179, file_version=4665345, image_size=216050)
41:26.884 DEBUG OTA image_block handler for '_TZ3000_xr3htd96 TS0201': field_control=2, manufacturer_id=4417, image_type=54179, file_version=4665345, file_offset=0, max_data_size=64, request_node_addr=None, block_request_delay=0
41:26.884 DEBUG OTA upgrade progress: 0.0
...
52:28.627 DEBUG OTA image_block handler for '_TZ3000_xr3htd96 TS0201': field_control=2, manufacturer_id=4417, image_type=54179, file_version=4665345, file_offset=215960, max_data_size=64, request_node_addr=None, block_request_delay=0
52:28.627 DEBUG OTA upgrade progress: 100.0
52:28.977 DEBUG Received command 0x06 (TSN 27): upgrade_end(status=<Status.SUCCESS: 0>, manufacturer_code=4417, image_type=54179, file_version=4665345)
52:28.977 DEBUG OTA upgrade_end handler for '_TZ3000_xr3htd96 TS0201': status=Status.SUCCESS, manufacturer_id=4417, image_type=54179, file_version=4665345

This means it is possible to upload your own OTA...

The firmware specifies two types: _TZ3000_qsefbina _TZ3000_xr3htd96

robvanoostenrijk commented 5 months ago

Awesome, so it looks like it might be possible to modify this device to pvvx firmware without physical chip flashing!

In the mean while, I've ordered a CH340N to flash my TS0201 (_TZ3000_xr3htd96). I'll try to follow your guide, since I have absolute zero experience in USB-TTL flashing.

pvvx commented 5 months ago

Firmware of original Tuya using Zigbee OTA to BLE version 1141-d3a3-00993001-TS0201_v45.zigbee

It is impossible to restore the original Tyua. Only a hardware programmer when writing a special bootloader or writing the original Full Flash.

robvanoostenrijk commented 5 months ago

@pvvx,

That's really awesome!

So the process would be:

1) On original TS0201 (_TZ3000_xr3htd96), use OTA 1141-d3a3-00993001-TS0201_v45.zigbee to convert to BLE 2) Use TelinkMiFlasher to update BLE/configs, or convert to pvvx Zigbee version from https://github.com/pvvx/ZigbeeTLc

web2brain commented 5 months ago

Hey, that is what I tried today - but it seems like I was not too successful. The first step (flashing 1141-d3a3-00993001-TS0201_v45.zigbee) worked:

2024-02-02 16:20:01.741 DEBUG (SyncWorker_5) [zigpy.ota.provider] ImageKey(manufacturer_id=4417, image_type=54179): /config/zigpy_ota/1141-d3a3-00993001-TS0201_v45.zigbee, version: 10039297, hw_ver: (None, None), OTA string: Telink OTA BLE device
2024-02-02 16:20:02.372 DEBUG (MainThread) [zigpy.zcl] [0xCF70:1:0x0019] OTA query_next_image handler for '_TZ3000_xr3htd96 TS0201': field_control=0, manufacturer_id=4417, image_type=54179, current_file_version=70, hardware_version=None, model='TS0201'
2024-02-02 16:20:02.379 DEBUG (MainThread) [zigpy.zcl] [0xCF70:1:0x0019] OTA image version: 10039297, size: 75442. Update needed: True
2024-02-02 16:20:04.287 DEBUG (MainThread) [zigpy.zcl] [0xCF70:1:0x0019] OTA image_block handler for '_TZ3000_xr3htd96 TS0201': field_control=2, manufacturer_id=4417, image_type=54179, file_version=10039297, file_offset=0, max_data_size=64, request_node_addr=None, block_request_delay=0
2024-02-02 16:20:04.287 DEBUG (MainThread) [zigpy.zcl] [0xCF70:1:0x0019] OTA upgrade progress: 0.0
2024-02-02 16:20:04.292 DEBUG (MainThread) [zigpy.zcl] [0xCF70:1:0x0019] Sending reply: ImageBlockResponseCommand(status=<Status.SUCCESS: 0>, manufacturer_code=4417, image_type=54179, file_version=10039297, file_offset=0, image_data=b'\x1e\xf1\xee\x0b\x00\x018\x00\x00\x00A\x11\xa3\xd3\x010\x99\x00\x02\x00Telink OTA BLE devic')
...
2024-02-02 16:23:55.424 DEBUG (MainThread) [zigpy.zcl] [0xCF70:1:0x0019] OTA image_block handler for '_TZ3000_xr3htd96 TS0201': field_control=2, manufacturer_id=4417, image_type=54179, file_version=10039297, file_offset=75440, max_data_size=2, request_node_addr=None, block_request_delay=0
2024-02-02 16:23:55.424 DEBUG (MainThread) [zigpy.zcl] [0xCF70:1:0x0019] OTA upgrade progress: 100.0
2024-02-02 16:23:55.543 DEBUG (MainThread) [zigpy.zcl] [0xCF70:1:0x0019] Received command 0x06 (TSN 186): upgrade_end(status=<Status.SUCCESS: 0>, manufacturer_code=4417, image_type=54179, file_version=10039297)
2024-02-02 16:23:55.547 DEBUG (MainThread) [zigpy.zcl] [0xCF70:1:0x0019] OTA upgrade_end handler for '_TZ3000_xr3htd96 TS0201': status=Status.SUCCESS, manufacturer_id=4417, image_type=54179, file_version=10039297

But afterwards the device does not show up in TelinkMiFlasher.html and pressing the reset button with a pin does not enable the red LED, whether I press it briefly, for 5 or 10 seconds.

Did I brick the device? Any chance to get the custom firmware on it? Preferrable OTA?

Looking forward to a solution.

frias0 commented 5 months ago

Did I brick the device? Any chance to get the custom firmware on it? Preferrable OTA?

Looking forward to a solution.

Did the exact same, basically at the same time as you.

web2brain commented 5 months ago

Did the exact same, basically at the same time as you.

And unfortunately with the same result, I assume?

frias0 commented 5 months ago

And unfortunately with the same result, I assume?

Yes :( Is the CH340N just a normal usb to serial? I might try that, or maybe just wait for an answer from pvvx guru.

robvanoostenrijk commented 5 months ago

I ordered my USB-TTL from here: https://a.aliexpress.com/_oDK6WtG

Its listed as advised on the Tasmota GitHub flashing guide. It hasn't got here yet, so can't confirm it works.

Also could go with a noob guide by PVVX on how to flash it. I opened the device and it has holes in the ISP connector pads, so it seems like Dupont male cable pins could work?

pvvx commented 5 months ago

Something is wrong with version 1141-d3a3-00993001-TS0201_v45.zigbee. I had to bypass the Tyua bootloader differently...

robvanoostenrijk commented 5 months ago

As I'm totally new to flashing and looking to recover the unbootable device. I hope you can shed some light on this.

My sensor board is identical to image

This is the USB-TTL device I have:

image

For successful flashing, how do I wire it up?

My assumption is:

USB-TTL TS0201
3v3 vdd
GND GND
? SWS
RST RST
TXD PB7 (RX)
RXD PB1 (TX)

The image in the github README indicates different points though: image

After this, run https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html?

pvvx commented 5 months ago
USB-TTL TS0201
3v3 vdd
GND GND
TXD SWS
RST RST
web2brain commented 4 months ago

Hi @robvanoostenrijk did you manage to reflash your sensor yet? I didn't, as I don't have a USB-TTL device yet, but am interested to know what you did exactly, as I am new to this as well.

robvanoostenrijk commented 4 months ago

My USB-TTL device got delivered a few days ago, so I finally had the chance to try it using @pvvx's instructions.

Sad to say that I've been unsuccessful so far.

I wired up the USB-TTL according to the table shared before: photo1708513065 (1)

photo1708513065

Then I ran the https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html webpage with the following firmware https://github.com/pvvx/BLE_THSensor/raw/master/source/TS0201/bin/TS0201_v45.bin.

The web flasher seems write the data and indicate all is fine, but as the documentation says its a 'dumb flasher'. So perhaps its not doing it properly after all.

The device is still dead after flashing (no LED light). Any advice from @pvvx on what I am doing wrong and/or alternate steps would be appreciated.

I tried the USB-TTL on Windows (appears as COM3) with the UART python flashing tool linked as well, but it just says "Failed to open port COM3".

There's a third more complex flasher mentioned, but it talks about PD3 and PD4 pins. So I am not sure if the wiring scheme that pvvx shared before is valid there.

web2brain commented 4 months ago

From my understanding, your wiring is not correct. I think that the numbering from pin 1 to 6 (https://pvvx.github.io/TS0201_TZ3000/) starts at the left if you have the board placed like you did, so ISP is readable. This would also be the same wiring (skipping vdd) as the image in the Readme.

So my guess is that you should change just one cable on the USB adapter as following (leaving them with brown-red-orange-yellow on the board):

What do you think? Worth a try?

robvanoostenrijk commented 4 months ago

@web2brain Indeed worth a try. Not sure what brainfart I had earlier. I can confirm that putting the wires correctly (duh) indeed successfully flashed the device back to life.

image

image

Bonus, Zigbee2MQTT converter for TS0201-z (screenshot above was before that): ZTS0201Z3000.js.txt

@pvvx, can you confirm the Zigbee OTA conversion file works on an untouched TS0201? Because I have one more, but it would be nice not to fiddle with the wires again.

web2brain commented 4 months ago

Great news @robvanoostenrijk , now I just have to find (or buy) a USB-TTL device :)

robvanoostenrijk commented 4 months ago

Great news @robvanoostenrijk , now I just have to find (or buy) a USB-TTL device :)

This is the one I'm using: https://www.aliexpress.com/item/1005004742270942.html Its $0.85 only. I also bought some dupont male to female cables which I ended up stripping on one side to fit in the ISP connector. (The dupont male pins were too large)

All-in, the USB-TTL + dupont cables were far less than the sensor originally (which already was not expensive).

robvanoostenrijk commented 4 months ago

I've now tested the new Zigbee conversion file provided by @pvvx: 141-d3a3-00993001-TS0201_v45.zigbee

In order for Zigbee2MQTT to do the update, you'll need to modify the TS0201 converter to support OTA. Ideally this means adding ota: ota.zigbeeOTA in the properties in tuya.ts. For ZHA the update just requires placing the OTA file.

Once the update completes, pop the batteries and leave the device sitting for a while. It will now show in TelinkMiFlasher as THS_xxxxxx. (I didn't not remove the batteries long enough earlier and it refused to show up)

Grab the pvvx Zigbee firmware 1141-0211-01203001-ZTS0201Z3000.zigbee and flash it using TelinkMiFlasher

After this it should join as a Zigbee device just fine.

Thanks to @pvvx making it possible to convert these devices from stock to pvvx ZigbeeTlc firmware over OTA directly!