Another ZTU sensor: TH03Z

[user784213]

Hi, I bought a similar round sensor: TH03Z The sensor uses a ZTU module and a 2450 battery. Ali: https://aliexpress.ru/item/1005005942067380.html

I think the sensor is being used: GXHT30 The GXHT30 sensor is fully compatible with the SHT30 sensor.

I tried to flash the firmware from the TS0201 sensor, but instead of readings, as expected, I received zero values :) (I don’t think it was worth removing the protective film from the sensor, but I did it while trying to find the markings)

[pvvx]

You need to know where the pins are connected:

1. SDA I2C
2. SCL I2C
3. Buttons
4. LED
5. The sensor power supply may be connected to the GPIO pin?
6. Which GPIO pin is connected to +Vbat and is there one?

Image from the soldering side!

https://developer.tuya.com/en/docs/iot/ztu-module-datasheet?id=Ka45nl4ywgabp

[user784213]

I used a multimeter and checked the connections ~

Sensor: SDA <-> C2 SCL <-> C3 ADDR <-> GND

Other: GND <-> Button <-> C0 LED <-> B4

5. The sensor is powered directly from the battery
6. No GPIO pin is connected to +Vbat, only VCC

[pvvx]

Added beta version for TH03Z (GXHT30 sensor).

What numbers does Zigbee OTA have for the original Tuya version?

[user784213]

I installed the new firmware a few hours ago. I can say that the new firmware works great!

The TH03Z sensor readings are very close to the LYWSD03MMC readings.

Unfortunately, I did not save the original TH03Z firmware. OTA version values are lost :( But later I’ll buy another sensor like this and look at the original firmware.

[pvvx]

I ordered TH03Z for $ 2.96 to replenish the collection. Goes by mail ...

[foxalex85]

How can I install the first time the TH03Z? With custom firmware, the sensor use BLE to send the data? Thanks

[user784213]

How can I install the first time the TH03Z? With custom firmware, the sensor use BLE to send the data? Thanks

Connect USB-TTL to the sensor PCB according to the diagram below: After that, use the link to flash the sensor: The simplest Telink-Swire emulator programmer without feedback: WebUSBCOMflasher

After the firmware is installed, the sensor will work using BLE technology similar to LYWSD03MMC, only without a display.

[user784213]

I noticed one unpleasant feature: TH03Z (purple) signal is much weaker than the LYWSD03MMC (blue) signal. Both devices have a power of 0dBm and are located nearby:

This applies to all devices on the ZTU module. They have a weak signal.

[pvvx]

Have you tried changing the orientation of the sensor? The signal may vary depending on the direction of the antenna...

[user784213]

I checked. You are right, position 2 really significantly improves the signal quality and its stability, but it still falls far short of the signal quality of the LYWSD03MMC...

[slingel]

should i try and flash ?

RSH-HS06 "manufacturerName":"_TZ3000_zl1kmjqx" "imageTypeId":65535 "currentFileVersion":268513281

[pvvx]

"imageTypeId":65535 - This is the wrong number.

You can read the correct numbers when calling OTA in the Zigbee log.

Manufacturer Code	Image Type	File Version - Stack Version
?	?	0x10013001 (268513281)

Sample for '_TZ3000_xr3htd96 TS0201':

2024-02-01 02:41:21.310 DEBUG (MainThread) [zigpy.zcl] [0x9289:1:0x0019] Decoded ZCL frame: Ota:QueryNextImageCommand(field_control=<FieldControl: 0>, manufacturer_code=4417, image_type=54179, current_file_version=70)

manufacturer_code=4417 (0x1141), image_type=54179(0xD3A3), current_file_version=70(0x0046))

[slingel]

Received Zigbee message from '0xa4c138c616b8f788', type 'commandQueryNextImageRequest', cluster 'genOta', data '{"fieldControl":0,"fileVersion":268513281,"imageType":515,"manufacturerCode":4417}' from endpoint 1 with groupID 0

[pvvx]

"fileVersion":268513281 = 0x10013001 ,"imageType":515 = 0x203,"manufacturerCode":4417 = 0x1141

This is the firmware from devbis for Xiaomi LYWSD03MMC. :)

ZigbeeTlc firmware for TH03Z was ready yesterday. But no one gives the correct data for flashing the Zigbee OTA version of Tuya. And while there is no - there is no firmware. So no one needs alternative Zigbee firmware(?)

[zalatnaicsongor]

I can get you the manufacturer_code, image_type, and current_file_version when my TH03Z has arrived.

[pvvx]

https://github.com/pvvx/ZigbeeTLc/issues/67#issuecomment-1978314832

[traeu]

I'm having trouble flashing my TH03Z to BLE. My goal is to use them like my LYWSD03MMC. I don't have any zigbee infrastructure, so I tried to flash "TH03Z_v47.bin" via USBCOMFlashTx.html. My PCB looks exactly like the ones on the pictures here. I use CH340G as USB-TTL-adapter. I tried both with RTS pin of CH430 connected to RST, and also connecting RST manually to ground as decribed here (https://github.com/pvvx/BLE_THSensor/issues/3#issuecomment-1823586519). Also, I erased flash before flashing TH03Z_v47.bin. Result is: No LED light is visible after flashing (original firmware turns on the LED for a short time after connecting the battery), and no new BLE device is found with TelinkMiFlasher.html (my old LYWSD03MMC are getting found without problems). I tried with two different TH03Z with the same result. Now I am a little scared and don't want to try it again with my third and last one. I don't know if I killed my devices or if they received the new firmware but somehow don't boot correctly or don't advertise BLE. Because the same happened to both at the same time (no LED visible after connecting battery, since first or second try flashing firmware) I hope they are not really dead, but how can I know? I tried flashing the firmware again multiple times and checked if TelinkMiFlasher.html found anything new after each try, but no new device were found.

Is there something basic I missed?

Should the LED also light up with new firmware after inserting battery? If not, it would be cool if the new firmware would be able to give some unique LED signal after inserting the battery, so one could see if flashing was successful and also to tell if original or custom firmware is running.

[KirillMMM]

Переведете ""Подключайте только провода TX-SWS и GND. При Активации использовать сброс чипа. Закоротив вывод RST самого чипа TLSR825x на GND во время стартовой активации"" Появится должно THS_... с 6 цифр мака Да светодиод отключен

[traeu]

I managed to flash my TH03Z successfully. Here are a few things I did when I finally had success. I don't know if everything contributed to my success (probably not)

-MacOS/Macbook did not work for me. I don't know why, but I think that was my main problem. I just could not get it to work on my 2021 Macbook Pro and Chromium Ungoogled as browser. Erasing the flash seemed to work, after that the LED did not light up at boot anymore (so the old firmware must have been gone). But I never had success flashing the new firmware. I don't know if this is related to my CH340 USB-TTL-adapter and maybe other adapters work with MacOS. It's the first time I experienced this kind of issue, in the past I often flashed ESP32 and ESP8266 boards with CH340 without any problems. In the end, I used my old skylake Win10 machine (and Edge as browser), and I was successful at first try.

-I connected GND, VCC and TX to my USB-TTL-adapter. Connecting the RST pin was not necessary. I shorted it by hand to ground. I can't tell if it also works without connecting VCC, because I tried that only with MacOS. After I had success with Windows and connected VCC, I forgot to also test Windows + disconnected VCC.

-I used the default Atime of 3 sec. At first, I increased it to have more time for shorting RST, but then I thought it's maybe better to leave it at the default value. Being quick at shorting RST to ground is easy: Grab a piece of thin unisolated wire or a needle, then start the flashing process, then quickly connect RST to the metal case of the MCU directly above it, only for a short time. I practiced it a bit while stock firmware was running. Because the stock firmware turns on the LED at boot, you see when a reset was successful.

-I first erased all flash before flashing custom firmware (obvious, also described in official documentation)

-To make sure to have a reboot after flashing, I disconnected all wires right after flashing was done and connected the battery. Then, scanning with TelinkMiFlasher.html showed the new device right away.

Another thing I noticed: -Flashing TH03Z_v47.bin with USBCOMFlashTx.html always takes around 30 seconds, no matter what BAUD is selected. So maybe BAUD setting doesn't do anything? There is no need to change it anyway, I just tried it at some point because I was desperate.

[pvvx]

Should the LED also light up with new firmware after inserting battery?

The LED lights up when the button is pressed.

--

Added to README:

USBCOMFlashTx.html - Uses a partial imitation of the Telink 1-Wire protocol on a USB-UART adapter, but only for transmission to the chip.

For programming and debugging, the chip uses a special hardware protocol Telink 1-Wire (not even close to UART!).

To match the frequencies of the Telink 1-Wite bus, no change in Baud-rate is required.

While the chip is sleeping and when the SWS pin is reassigned, there is no access to programming.

You can restore communication via “Telink 1-Wire” by rebooting the chip and sending a command to stop the CPU. This is called "Activation".

The USBCOMFlashTx.html program does not have feedback - it does not receive data from the chip. This is a simplified version and only works if all connections are made correctly.

Alternative programmers:

1. TLSR825xComFlasher.py - partial simulation of Telink 1-Wire on a USB-UART adapter.
2. TlsrComProg - uses a bootloader with the transition to working via the UART protocol.
3. TLSRPGM - full hardware option Telink 1-Wire up to 2 mbit/s

[traeu]

You are right, position 2 really significantly improves the signal quality and its stability, but it still falls far short of the signal quality of the LYWSD03MMC...

I also made some comparison against LYWSD03MMC. All with TX power +0.04 dbm. I placed one LYWSD03MMC and three TH03Z at three different places around the receiver (ESP32 with tasmota). Each TH03Z was set in a different orientation, positioned like on @user784213 's pictures 1, 2 and 4. Looks like LYWSD03MMC has the best signal strength, even at a place where only one of the TH03Z was able to transmit something. But I guess that's just a hardware limitation and the only thing I can do is move closer to the receiver, get a better receiver or increase TX power (wondering how big the impact on battery life would be).

[traeu]

Another thing I noticed: The default sensor settings don't look right. After flashing TH03Z_v47.bin, I see humidity around 95%. Sensor settings show: SHT4x Temperature slope factor: 175.00, Zero Offset: -45.00 Humidity slope factor: 200.00, Zero Offset: 0.00

For comparison, 4 of my LYWSD03MMC show: SHTv3 Temperature slope factor: 175.00, Zero Offset: -45.00 Humidity slope factor: 100.00, Zero Offset: 0.00

And my other 4 LYWSD03MMC show: SHT4x Temperature slope factor: 175.00, Zero Offset: -45.00 Humidity slope factor: 125.00, Zero Offset: -6.00

What would be good default values for TH03Z sensors?

[pvvx]

What would be good default values for TH03Z sensors?

For TH03Z (fw) default values have been corrected.

Humidity slope factor: 100.00, Zero Offset: 0.00

But I guess that's just a hardware limitation and the only thing I can do is move closer to the receiver, get a better receiver or increase TX power (wondering how big the impact on battery life would be).

The module layout on the main PCB is incorrect. Documentation for the module Module ZTU:

Incorrect placement of antenna modules occurs on many Tuya devices.

Antenna wiring and matching on Tuya modules is poorly done. This creates an additional deterioration in the levels of radio reception and transmission.

(wondering how big the impact on battery life would be)

Increasing the transmission level of the chip itself has a non-linear dependence on consumption. CRxxx batteries are particularly susceptible to increased peak current. These batteries increase internal resistance and the load causes a voltage drop. For example, for the CR2032, the +2 dB transmit level setting is maximum when operation is maintained at 1/3 battery level. During TX, the voltage drops below the operating minimum and the battery cannot be used at 100%.

[traeu]

thanks for your very detailed explanations! I flashed my TH03Z again, now the default values are as you said.

Just curious: How do you know the right default values? I saw that my LYWSD03MMC with SHTv3 use: Humidity slope factor: 100.00, Zero Offset: 0.00 And that my LYWSD03MMC with SHT4x use: Humidity slope factor: 125.00, Zero Offset: -6.00 I would have guessed that, based on that, my TH03Z with SHT4x would also use 125.00 / -6.00

[pvvx]

The values used are according to the sensor manufacturer's documentation: SHT4x SHTv3(SHTC3)

[traeu]

Alright, now I understand my mistake. I was confused because TelinkMiFlasher.html showed "SHT4x" as sensor for TH03Z (and for SHT4x, humidity slope factor 125.00 and zero offset -6.00 would be correct). But because the sensor in TH03Z is GXHT30, slope factor 100.00 and zero offset 0.00 is correct.

Thank you again for your great work, it's amazing how much you improved this cheap devices and I really love playing with them.