TH03 custom firmware #129

vkravets · 2024-11-14T10:18:55Z

Is any chance to upload custom firmware analogue of TH03Z with LCD?

https://www.aliexpress.com/item/1005007309529179.html?spm=a2g0o.order_list.order_list_main.11.a23b1802WLv9gX#nav-specification

The issue of zigbee2mqqt Koenkk/zigbee2mqtt#23983

pvvx · 2024-11-14T15:35:13Z

https://pvvx.github.io/TS0601_TZE204/
It won't work without desoldering an additional chip (Tuya MCU). The display and sensor are connected to it, and communicate via UART with confirmation of Tuya keys. This chip provides additional battery consumption.
Modification is required - desoldering the chip and soldering jumpers. Approximately like https://pvvx.github.io/TS0601_TZE200_zth01/
But it's easier to throw it away, because the accuracy of the readings is very limited, and the sensor polling period by the additional MCU is too long - half an hour.

vkravets · 2024-11-14T15:39:45Z

the display will work in this case?

pvvx · 2024-11-14T15:41:47Z

The required firmware and the option of how to solder the jumpers have not yet been made.

vkravets · 2024-11-14T15:49:17Z

I'm ready to be a tester of it ) I can desoldering/soldering, I don't have soldering fan, but I think I can find how to desoldering the Tuya MCU

pvvx · 2024-11-14T15:56:36Z

I have the following names in the firmware of the ZTH05 thermometer from Tuya:
TS0601_TZE204_f8mujzmz
TS0601_TZE204_upagmta9

There are 4 types of sensors possible on the PCB.

vkravets · 2024-11-14T16:00:05Z

Let you know when recheck with my device

juha63 · 2024-11-14T18:19:05Z

Could you please share some photos of the pcb and the imprint of both chips? I have a working solution for ZTH05 https://pvvx.github.io/TS0601_TZE204/. Maybe this works with small changes on your device.

vkravets · 2024-11-14T19:42:23Z

I don't see any tuya mcu unit

It's more similar to th05 but ZigBee version

pvvx · 2024-11-15T00:43:28Z

I don't see any tuya mcu unit

Yes, it is completely different from ZTH05.
But the main chip is unknown.

vkravets · 2024-11-15T11:31:52Z

Zigbee2MQQT detects it as following device:

vkravets · 2024-11-15T11:54:08Z

How we can detect or debug which chip is used? Is it possible to take off the metalic holder at top?

juha63 · 2024-11-15T13:12:13Z

Looks like the metal (rf) cap is soldered to the pcb. True? Maybe it's also fixed with latches through hole? Then you have to take your hot air gun and desolder the whole pcb first and then the cap. Of course there will be a good chance that you'll destroy the "chip". It depends on your soldering skills.

pvvx · 2024-11-15T13:36:43Z

Mac/IEEE address from Telink. Perhaps there TLSR8258.
I ordered a similar one on AliExpress.

It will not be fast ...
Have to open it, as it is necessary to find out how the chip conclusions are divorced.

vkravets · 2024-11-15T13:43:41Z

I'm already ask my friend to desoldering metal cup, so in any case give you info what inside )

vkravets · 2024-11-15T13:45:00Z

In description of the to the issue I post the link to ali also )

pvvx · 2024-11-15T13:46:41Z

By the link https://www.aliexpress.com/item/1005007309529179.html
(from the first message) is not delivered to my region.

I ordered these:
https://aliexpress.ru/item/1005007924605101.html

The price is the same.
But LYWSD03MMC is better and cheaper.
The TH03Z LCD controller BL55028 consumes more than the controller in the LYWSD03MMC.
Datasheet: LCD Driver BL55028 - Operation voltage: 2.5~5.5V
That is, there is no way to fully utilize CR2032.
The AHT20 has more consumption than the sensors in the LYWSD03MMC. And the AHT20 gives less accurate readings.

The main differences between Xiaomi and Tuya sensors are that Xiaomi always has a larger communication radius due to the correct layout of the printed antenna and all components are of significantly higher quality.

vkravets · 2024-11-15T14:41:43Z

Hmm, in this case will buy LYWSD03MMC for sure... )

About the desoldering metal cup... bad news there is no any mark for the chip )

vkravets · 2024-11-15T14:52:52Z

By the link https://www.aliexpress.com/item/1005007309529179.html
(from the first message) is not delivered to my region.

In my case the same, but do diff region it can be delivered. Thus I select the city where it's posible and in adress line specify my postal code and my city with the street. Postal company route to needed place without any issue )

You can try to do this in the same way. Great lifehack )

vkravets · 2024-11-15T14:56:15Z

TLSR8258

Can I try to use Zigbee OTA to flash custom firmware? Above picture can help to understand if it's TLSR8258?

pvvx · 2024-11-15T15:05:13Z

TLSR8258F512ET32 ?
https://wiki.telink-semi.cn/wiki/chip-series/TLSR825x-Series/

vkravets · 2024-11-15T15:10:09Z

As I know BLE is not here ( only zigbee... or BLE can be not powered during init the chip?

Without Zigbee it seems it's TLSR8656F512ET32

pvvx · 2024-11-15T15:15:40Z

Quartz at 24.0 MHz, like all TLSR825x.
The conductors on the module are not visible in the photo. But the general arrangement of the elements roughly corresponds to TLSR825x.

All TLSR825x have the same crystal. The only difference is in the plastic case and what pins are made from the crystal.
Support all types of BLE PHY - 2M, 1M, 500k, 125k and Zigbee - 250k. All have the same RAM size - 64 KB, but can have different Flash. Different number on the plastic (TLSR8250, 8251, 8253, 8258) = marketing.

vkravets · 2024-11-15T15:18:06Z

Where I can take custom firmware and how to flash?

pvvx · 2024-11-15T15:23:35Z

For the TH03Z variant, the firmware needs to be created. Find out which pins go where, how the LCD segments are routed. Take the source code and write... :)

Or wait until I get TH03Z and create firmware for it, make changes to TelinkMiFlasher and other software, finish writing all the README, check the work with the new TH03Z firmware... Not before the New Year.

vkravets · 2024-11-15T15:29:34Z

I can also invistigate, I have only one question if something goes wrong how to flash via UART... since I'm not sure where the uart pins to flash... May be by photos you already find them? )

vkravets · 2024-11-15T15:31:09Z

vkravets · 2024-11-15T15:35:20Z

It seems TX under P2 section (numeation from P2 text)

VCC+ 3.3v
TX
GND

But while connection nothing happens (

pvvx · 2024-11-15T15:38:39Z

First, you need to read the existing Tuya firmware.

The simplest option:
https://github.com/pvvx/TlsrComSwireWriter
https://github.com/pvvx/TlsrComSwireWriter/blob/master/TLSR825xComFlasher.py

Datasheet DS_TLSR8258-E_Datasheet for Telink BLE IEEE802.15.4 Multi-Standard Wireless SoC TLSR8258.pdf :

vkravets · 2024-11-15T15:46:43Z

Ok, I have USB-Serial TTL can I use it also? But is not clear how to use RST?

pvvx · 2024-11-16T07:46:37Z

If this is so new to you, how will you create the firmware?

Pictures of wires won't do. A map of the segments on the LCD glass is required. Example -https://github.com/pvvx/ATC_MiThermometer/blob/master/src/lcd_mho_c122.c#L19-L41
Next, you need to rework the code to handle the output of data to the display.

PS: Only one firmware version was created, which was created without taking into account the thermometer I had, based on FaBjE data.
Here is an example of the steps that need to be taken.

vkravets · 2024-11-16T11:45:16Z

I'm able to read the firmware

$ TLSR825xComFlasher.py --port /dev/tty.wchusbserial53220378511 -d -t 500  rf 0 0x10000 1.bin
=======================================================
TLSR825x Flasher version 00.00.05
-------------------------------------------------------
Open /dev/tty.wchusbserial53220378511, 921600 baud...
Reset module (RTS low)...
Activate (500 ms)...
Debug: default swdiv for 24 MHz = 52 (0x34)
Debug (read data):
000023: 3b 3b fa
Debug (read data):
000024: 3b 3b bb
Debug (read data):
000025: 3f 3b a3
Debug (read data):
000026: 3f 3f bc
Debug (read data):
000027: 3f 3f 84
Debug (read data):
000028: 77 c7 bf
Debug (read data):
000029: 77 c7 47
Debug (read data):
00002a: 77 47 74
Debug (read data):
00002b: 77 47 44
Debug (read data):
00002c: 77 47 77
Debug (read data):
00002d: f7 87 87
Debug (read data):
00002e: f7 87 f4
Debug (read data):
00002f: f7 87 84
Debug (read data):
000030: ff f0 ff
Debug (read data):
000031: ef f8 8f
Debug (read data):
000032: ef 88 0f ef
Debug (read data):
000033: ef 08 ef 08 ff
Debug (read data):
000034: ef 08 0f ef ff
Debug (read data):
000035: ef 08 0f 0f ff
Debug (read data):
000036: ef 08 0f e8 ff
Debug (read data):
000037: ef 08 0f 08 ff
Debug (read data):
000038: ef 08 e8 ef ff
Debug (read data):
000039: cf 08 e8 0f ff
Debug (read data):
00003a: df 08 e8 d8 ff
Debug (read data):
00003b: df 08 d8 08 ff
Debug (read data):
00003c: df 18 18 df ff
Debug (read data):
00003d: df 10 10 1f ff
Debug (read data):
00003e: df 10 10 d0 ff
Debug (read data):
00003f: df 10 10 10 ff
Debug (read data):
000040: 1f df df df ff
Debug (read data):
000041: 1f df df 1f ff
Debug (read data):
000042: 1f df df d0 ff
Debug (read data):
000043: 1f 9f 9f 10 ff
Debug (read data):
000044: 3f 9f 1f bf ff
Debug (read data):
000045: 3f bf 1f 1f ff
Debug (read data):
000046: 3f bf 3f b0 ff
Debug (read data):
000047: 3f bf 3f 30 ff
Debug (read data):
000048: 3f bf b0 bf ff
Debug (read data):
000049: 3f bf b0 3f ff
Debug (read data):
00004a: 3f bf a0 a0 ff
Debug (read data):
00004b: 3f 3f a0 20 ff
Debug (read data):
00004c: 3f 3f 20 3f ff
Debug (read data):
00004d: 3f 3f 20 3f ff
Debug (read data):
00004e: 3f 3f 60 20 ff
Debug (read data):
00004f: 7f 3f 20 20 ff
Debug (read data):
000050: 7f 7f 7f 7f ff
Debug (read data):
000051: 7e 7f 7f 7e ff
Debug (read data):
000052: 7e 7e 7f 60 ff
Debug (read data):
000053: 7e 7e 7f 60 ff
Debug (read data):
000054: 7e 7f 7f 7e ff
Debug (read data):
000055: 7e 7f 7e 7f ff
Debug (read data):
000056: 7e 7e 7f 60 fe
Debug (read data):
000057: 7e 7e 7e 40 fe
Debug (read data):
000058: 7e 7e 40 7f fe
Debug (read data):
000059: fe 7e c0 7e fe
Debug (read data):
00005a: fe fe 40 c0 fe
Debug (read data):
00005b: fe fe c0 c0 fe
Debug (read data):
00005c: fe fe c0 fe fe
Debug (read data):
00005d: fe fe c0 fe fe
Debug (read data):
00005e: fe fe c0 c0 fe
Debug (read data):
00005f: fe fe c0 c0 fe
Debug (read data):
000060: fe c0 fe fe fe
Debug (read data):
000061: fe c0 fe fe fe
Debug (read data):
000062: fe c0 fe c0 fe
Debug (read data):
000063: fe 80 fe fe c0
Debug (read data):
000064: fe 80 fe 80 fe
Debug (read data):
000065: fe 80 80 fe fe 80 80 fe
Debug (read data):
000066: fe 80 80 fe fe 80 80 fe fe
Debug (check data):
0ccc66: 80 fe 80 80 fe fe 80 80 fe fe
bit mask: 0xc0
UART-SWS 92160 baud. SW-CLK ~47.0 MHz(?)
Outfile: 1.bin
Read Flash from 0x000000 to 0x010000...
-------------------------------------------------------
Worked Time: 286.621 sec

Done!

original-firmware-th03-v1.1.bin.zip

vkravets · 2024-11-16T11:46:22Z

Using following connection:

TX -> R 1k -> SWS
RX         -> SWS
RST        -> VCC+
GND        -> GND

pvvx · 2024-11-16T12:12:40Z

I'm able to read the firmware

TLSR8258 use 1 MB or 512 KB Flash.

$ TLSR825xComFlasher.py --port /dev/tty.wchusbserial53220378511 -d -t 500  rf 0 0x100000 fullflash.bin

vkravets · 2024-11-16T14:27:00Z

Ahh, it's SRAM 64k ) So tiny and 512k...
Yep it's 512k, if choose to dump 1M after 512k take the same data from 0 offset.
original-firmware-th03-v1.1_512k.zip

vkravets · 2024-11-20T21:57:34Z

I have small progress for it

default firmware with small changes at config (without display) successfully have been upload and run
Zigbee paired and populate all info (bat, hum, temp)

Working on the display, since it's has the same display and controller as TH05 will try to take some info from it

vkravets · 2024-11-21T17:26:36Z

Have some additional info:

LCD driver is BL55028
LCD the same as TH05 (BLE version)
LCD driver connected to SoC via UART
- PB1/TX -> BL55028 SCI (Pin 3)
- PB7/RX -> BL55028 SDA (Pin 2)

As I understand this driver can works via i2c... Am I right? Since the same driver at TH05 connected via i2c as I can see from the code of it. Is not clear why it's connected to UART pins...

@pvvx Can you point me to the correct docs? Official docs mentioned i2c but in the table of pins mentioned serial in/out on the SDA pin of the driver.

Can I somehow using DEBUG UART to print somehow debug info?

pvvx · 2024-11-21T17:43:47Z

https://pvvx.github.io/TH-05/
Diver LCD: BL55028,

vkravets · 2024-11-21T17:50:46Z

Ok, I've already use this code. If it works only via i2c, in this case I'm going to find where the mistake. Thanks for documentation

pvvx · 2024-11-21T18:04:58Z

The LCD driver is the same as LYWSD03MMC B1.9.
First, the BLE firmware is made. It has an interface for specifying the bitmap of the segment layout in the LCD glass.

I have small progress for it

Without PowerProfiler, writing BLE or Zigbee firmware is useless.
All LCD and sensor settings and code must be checked for consumption. Datasheets, user manual for SDK never contain full descriptions. The same goes for all program code and algorithms used for a specific SoC.

Minimum for purchase PowerProfiler
https://www.nordicsemi.com/Products/Development-hardware/Power-Profiler-Kit-2
But it is possible to assemble a cheaper PowerProfiler yourself...

Can I somehow using DEBUG UART to print somehow debug info?

What other debug output in UART?
It will break BLE or Zigbee timings. Not applicable to BLE or Zigbee. Only high-speed interfaces can be used. For TSLR82xx without USB outputs, the built-in SWire debug interface from 1 Mbps is possible.
The chip wakes up for several ms, and UART requires a longer activity time. To work with UART, you will have to rewrite everything and build power from an external, more powerful source.

vkravets · 2024-11-22T12:34:02Z

The LCD driver is the same as LYWSD03MMC B1.9. First, the BLE firmware is made. It has an interface for specifying the bitmap of the segment layout in the LCD glass.

I've prepared BLE firmware with th following configuration:

#define DEVICE_LYWSD03MMC	3	// LCD display LYWSD03MMC
// HW_VER_LYWSD03MMC_B14 = 0
// HW_VER_LYWSD03MMC_B19 = 3
// HW_VER_LYWSD03MMC_B16 = 4
// HW_VER_LYWSD03MMC_B17 = 5
// HW_VER_LYWSD03MMC_B15 = 10

#define DEV_SERVICES ( SERVICE_OTA \
		| SERVICE_OTA_EXT \
		| SERVICE_PINCODE \
		| SERVICE_BINDKEY \
		| SERVICE_HISTORY \
		| SERVICE_SCREEN \
		| SERVICE_THS \
		| SERVICE_KEY \
		| SERVICE_LED \
)

#define USE_SENSOR_AHT20_30		1

#define GPIO_KEY2			GPIO_PD4	// key "Connect", input, pcb mark "P8"
#define PD4_INPUT_ENABLE	1
#define PD4_DATA_OUT		0
#define PD4_OUTPUT_ENABLE	0
#define PD4_FUNC			AS_GPIO
#define PULL_WAKEUP_SRC_PD4 PM_PIN_PULLUP_1M

#define GPIO_LED			GPIO_PC0 // (LED E)
#define PC0_INPUT_ENABLE	1
#define PC0_DATA_OUT		1
#define PC0_OUTPUT_ENABLE	0
#define PC0_FUNC			AS_GPIO
#define PULL_WAKEUP_SRC_PC0	PM_PIN_PULLDOWN_100K

#define PULL_WAKEUP_SRC_PB7	PM_PIN_PULLUP_1M // UART TX (B1.6)

And device up and I able to connect via BLE

I'm getting H&T data, battery, led and key is working but nothing with screen, it even don't turn on (
Detect as B1.6, according to code, nothing had been detected on i2c and fall back to 1.6

Any suggestions/ideas what I can do with LCD to init it?

vkravets · 2024-11-22T12:38:16Z

I've notice I can specify custom command which can be send to device, I'm interesting to I2C scan... How I can do this?

pvvx · 2024-11-22T13:53:49Z

Enter command "03"
View log and Chrome console....
https://github.com/pvvx/ATC_MiThermometer?tab=readme-ov-file#control-function-id-when-connected

https://github.com/pvvx/ATC_MiThermometer/blob/master/src/cmd_parser.h#L6
https://github.com/pvvx/ATC_MiThermometer/blob/master/src/cmd_parser.c#L270

vkravets · 2024-11-24T11:50:12Z

Have some additional info:

LCD driver is BL55028

LCD the same as TH05 (BLE version)

LCD driver connected to SoC via UART

PB1/TX -> BL55028 SCI (Pin 3)

PB7/RX -> BL55028 SDA (Pin 2)

My bad, I miss the R between driver, thus It's connected to I2C bus as needed with R1 which the same capacity as R3 for tha TH sensor. It's seems need to pullup some pin to wakeup it before I2C init

Sorry for it... My bad (

pvvx · 2024-11-27T18:12:27Z

https://pvvx.github.io/TS0201_TZ3000_TH03/

pvvx · 2024-11-28T02:50:37Z

BLE firmware "TH03_v48.bin" added.
TH03 power consumption is twice as much as LYWSD03MMC (!) The reason is the LCD driver chip and T&H sensor.
BL55028, Fig 7 -> Work at 1/3 bias, Vdd – Vlcd must be more than 2.9V.
The CR2032 battery gives out below 2.9V when transmitting radio with any thermometer (at a current of about 8mA).
That is, the installed BL55028 chip and LCD screen are not designed to work with CR2032. According to the documentation, it will only work for the first couple of days with a new battery...

Another emulation of a thermometer from Tuya = Buy and throw away.
There is no point in making Zigbee firmware....

https://pvvx.github.io/TS0201_TZ3000_TH03/ - Added measurements of the original Zigbee firmware consumption. It looks like this is a fake "Tuya" from "Sonoff". The Zigbee firmware is marked by the manufacturer as "Sonoff". The minimum current for TH03 when all chips are in sleep mode is 13 μA! This is how much LYWSD03MMC consumes when working in BLE with transmission every 2.5 seconds.

TH03 Tuya (Sonoff)Zigbee -> BLE:

vkravets · 2024-11-28T22:19:34Z

Thanks, for your work and quick response.
I'm agree with such power consumption there is no sence to continue work at ZB firmware.

Close.

In any case who dissagree can take work from BLE and migrate here

pvvx · 2024-11-29T20:00:00Z

Revert to original Tuya Zigbee firmware:

pvvx · 2024-11-30T00:06:29Z

TH03 ZigbeeTLc:

Default settings: Average current consumption 22..28 µA depending on the rate of change of temperature and/or humidity.

6 reports in 420 sec:

Average current consumption 25.2 uA.

vkravets changed the title ~~TH03 firmware~~ TH03 custom firmware Nov 14, 2024

vkravets closed this as completed Nov 28, 2024

pvvx mentioned this issue Nov 30, 2024

porting firmware for TS0201 _TZ3000_bguser20 #124

Open

TH03 custom firmware #129

TH03 custom firmware #129

Comments

vkravets commented Nov 14, 2024 • edited Loading

pvvx commented Nov 14, 2024 • edited Loading

vkravets commented Nov 14, 2024

pvvx commented Nov 14, 2024

vkravets commented Nov 14, 2024

pvvx commented Nov 14, 2024 • edited Loading

vkravets commented Nov 14, 2024

juha63 commented Nov 14, 2024 • edited Loading

vkravets commented Nov 14, 2024 • edited Loading

pvvx commented Nov 15, 2024

vkravets commented Nov 15, 2024

vkravets commented Nov 15, 2024

juha63 commented Nov 15, 2024

pvvx commented Nov 15, 2024 • edited Loading

vkravets commented Nov 15, 2024

vkravets commented Nov 15, 2024

pvvx commented Nov 15, 2024 • edited Loading

vkravets commented Nov 15, 2024

vkravets commented Nov 15, 2024

vkravets commented Nov 15, 2024 • edited Loading

pvvx commented Nov 15, 2024

vkravets commented Nov 15, 2024 • edited Loading

pvvx commented Nov 15, 2024 • edited Loading

vkravets commented Nov 15, 2024

pvvx commented Nov 15, 2024 • edited Loading

vkravets commented Nov 15, 2024

vkravets commented Nov 15, 2024 • edited Loading

vkravets commented Nov 15, 2024

pvvx commented Nov 15, 2024

vkravets commented Nov 15, 2024

pvvx commented Nov 16, 2024 • edited Loading

vkravets commented Nov 16, 2024

vkravets commented Nov 16, 2024 • edited Loading

pvvx commented Nov 16, 2024

vkravets commented Nov 16, 2024

vkravets commented Nov 20, 2024 • edited Loading

vkravets commented Nov 21, 2024 • edited Loading

pvvx commented Nov 21, 2024

vkravets commented Nov 21, 2024

pvvx commented Nov 21, 2024 • edited Loading

vkravets commented Nov 22, 2024 • edited Loading

vkravets commented Nov 22, 2024 • edited Loading

pvvx commented Nov 22, 2024

vkravets commented Nov 24, 2024 • edited Loading

pvvx commented Nov 27, 2024

pvvx commented Nov 28, 2024 • edited Loading

vkravets commented Nov 28, 2024

pvvx commented Nov 29, 2024

pvvx commented Nov 30, 2024 • edited Loading

vkravets commented Nov 14, 2024 •

edited

Loading

pvvx commented Nov 14, 2024 •

edited

Loading

pvvx commented Nov 14, 2024 •

edited

Loading

juha63 commented Nov 14, 2024 •

edited

Loading

vkravets commented Nov 14, 2024 •

edited

Loading

pvvx commented Nov 15, 2024 •

edited

Loading

pvvx commented Nov 15, 2024 •

edited

Loading

vkravets commented Nov 15, 2024 •

edited

Loading

vkravets commented Nov 15, 2024 •

edited

Loading

pvvx commented Nov 15, 2024 •

edited

Loading

pvvx commented Nov 15, 2024 •

edited

Loading

vkravets commented Nov 15, 2024 •

edited

Loading

pvvx commented Nov 16, 2024 •

edited

Loading

vkravets commented Nov 16, 2024 •

edited

Loading

vkravets commented Nov 20, 2024 •

edited

Loading

vkravets commented Nov 21, 2024 •

edited

Loading

pvvx commented Nov 21, 2024 •

edited

Loading

vkravets commented Nov 22, 2024 •

edited

Loading

vkravets commented Nov 22, 2024 •

edited

Loading

vkravets commented Nov 24, 2024 •

edited

Loading

pvvx commented Nov 28, 2024 •

edited

Loading

pvvx commented Nov 30, 2024 •

edited

Loading