Add support for Zemismart ZM79E-DT (Tuya)

[DomiStyle]

I recently found out that there is a Zigbee variant of the Zemismart curtain motors that have the Zigbee receiver included in the motor itself instead of the switch:

I paired it with zigbee2mqtt to check what it's sending and the receiving part is simple enough.

Started moving:

type 'commandSetDataResponse', cluster 'manuSpecificTuyaDimmer', data '{"status":0,"transid":1,"dp":1031,"fn":0,"data":{"type":"Buffer","data":[0]}}' from endpoint 1 with groupID 0

{
   "status":0,
   "transid":1,
   "dp":1031,
   "fn":0,
   "data":{
      "type":"Buffer",
      "data":[
         0
      ]
   }
}

Arrived at location (60% in this example):

type 'commandSetDataResponse', cluster 'manuSpecificTuyaDimmer', data '{"status":0,"transid":1,"dp":515,"fn":0,"data":{"type":"Buffer","data":[0,0,0,60]}}' from endpoint 1 with groupID 0

{
   "status":0,
   "transid":1,
   "dp":515,
   "fn":0,
   "data":{
      "type":"Buffer",
      "data":[
         0,
         0,
         0,
         60
      ]
   }
}

Range goes from 0-100, 124 means it is not calibrated yet. 100 is all the way open, 0 is all the way closed.

Now for the actual question: How to figure out what to send to control it? Do I need more info from Zemismart or can I get that information from the database entry?

{
   "id":59,
   "type":"Router",
   "ieeeAddr":"0x086bd7fffedae046",
   "nwkAddr":8448,
   "manufId":0,
   "manufName":"_TYST11_cowvfni3",
   "powerSource":"Mains (single phase)",
   "modelId":"owvfni3\u0000",
   "epList":[
      1
   ],
   "endpoints":{
      "1":{
         "profId":260,
         "epId":1,
         "devId":256,
         "inClusterList":[
            0,
            3,
            4,
            5,
            6
         ],
         "outClusterList":[
            25
         ],
         "clusters":{
            "genBasic":{
               "attributes":{
                  "modelId":"owvfni3\u0000",
                  "manufacturerName":"_TYST11_cowvfni3",
                  "powerSource":1,
                  "zclVersion":3,
                  "stackVersion":0,
                  "hwVersion":1,
                  "dateCode":"20180727"
               }
            }
         },
         "binds":[

         ]
      }
   },
   "appVersion":255,
   "stackVersion":0,
   "hwVersion":1,
   "dateCode":"20180727",
   "zclVersion":3,
   "interviewCompleted":true,
   "meta":{

   },
   "lastSeen":1586857228701
}

I saw that there is already a sendTuyaCommand function here for a thermostat. I assume I can use that for my purpose since the protocol looks identical.

A few more, smaller question:

• The motor keeps sending {"appVersion":73} 10x at a time, every few minutes. Does it expect a response?
• There is a null terminator (\u0000) in the modelId, judging by the existing entries I just take that over to the devices.json as is?
• Is it possible to send "raw" commands to a device via zigbee2mqtt for testing? Seems like a pain to have to restart after every change on the converter
• Is there a standard for which state is considered open? 0 or 100? 0 or 1? Float or integer? Home Assistant seems to handle it the same way as the motor (100 is fully open).

I took pictures of the motor, just for reference:

Data sheet of that chip is available here.

The motors all seem to be identical except the chip on the bottom is replaced by a Zigbee/wi-fi/Z-wave module.

[DomiStyle]

I was able to get the from zigbee working, it reads the position and state properly now.

I was also able to brute force some of the commands that are available but I'm still unsure what data I need to send. Is there a faster way to debug sending commands other than restarting zigbee2mqtt?

[Koenkk]

@kirovilya since you know more about TuYa devices, could you help with this?

[kirovilya]

@DomiStyle You can try to write your own command for device like here https://github.com/Koenkk/zigbee-herdsman-converters/blob/master/converters/toZigbee.js#L2057
and add it to toZigbee attribute of device (in devices.js).
for correct commands you must know them.
for example, make a sniff of device communication with the original gateway.

[DomiStyle]

@kirovilya Thanks, that's what I expected.

I just ordered one of their hubs to sniff the traffic. Will report back once I know more.

I also contacted Zemismart and Tuya, maybe they are willing to give out the protocol details too.

[DomiStyle]

Zemismart was nice enough to send me the full technical documentation (even including source code), so kudos to them for being so open about their products.

For future reference, @kirovilya
I worked from your comment here.

However, the description for dp is wrong (assuming the protocol is identical between devices).

The dp is actually split into two parts, the first byte is the value type and the second part is the actual dp identifier.

These are the types taken from their source code and should apply to all devices that use this protocol:

ID	Name	Description
0x00	DP_TYPE_RAW	?
0x01	DP_TYPE_BOOL	?
0x02	DP_TYPE_VALUE	4 byte unsigned integer
0x03	DP_TYPE_STRING	variable length string
0x04	DP_TYPE_ENUM	1 byte enum
0x05	DP_TYPE_FAULT	1 byte bitmap (didn't test yet)

My device doesn't use strings, raw and bool so I can't test them.

The second part is the actual ID for my device, I got this list from them:

ID	Name	Type	Description
0x01	control	enum	open, stop, close, continue
0x02	percent_control	value	0-100% control
0x03	percent_state	value	Report from motor about current percentage
0x04	control_back	enum	Configures motor direction (untested)
0x05	work_state	enum	Supposedly shows if motor is opening or closing, always 0 for me though
0x06	situation_set	enum	Configures if 100% equals to fully closed or fully open (untested)
0x07	fault	bitmap	Anything but 0 means something went wrong (untested)

The first part of the data is always the length (can be 0 for enums), followed by the actual data.

So a working command for my device would be

dp:

• 0x04 (Enum)
• 0x01 (Command ID)

data:

• 0x00 (Length, doesn't matter for enum)
• 0x02 (Enum value: open)

I got the following working so far:

• Reports position when it arrived (0-100%)
• Reports state (running: true & false)
• Allows setting position
• Allows running action (open, close, stop)

Still gotta integrate everything into Home Assistant and maybe add the available configuration options but everything is looking good so far.

[kirovilya]

@DomiStyle can you share docs to me too?

[DomiStyle]

@kirovilya Sent you a mail with the files.

[kirovilya]

thank you!

[DomiStyle]

Pull request was merged, closing this. Thanks for the help!

[pauln]

@DomiStyle @kirovilya Would one of you mind sharing the docs with me (or posting them somewhere publicly, if there's no restriction on doing so imposed by Zemismart)? I'm working on an ESPHome component for the wifi variant, and have most stuff figured out from what's been posted here and a bit of serial sniffing, but I'd love to see the full docs if possible.

[DomiStyle]

@pauln If you can post your email address or add it to your GitHub profile I can send it to you.

[pauln]

Thanks for sending it through! I'll take a proper look over the weekend - hopefully it'll let me finish my ESPHome component.

[artem-dudarev]

@DomiStyle Could you send me the Zemismart documentation too?

[DomiStyle]

@artem-dudarev Sent you a mail.

[artem-dudarev]

@DomiStyle Thank you!

[w35l3y]

I also am interested in this doc if you don't mind.

[DomiStyle]

@w35l3y Sent the files to your Github address.

[Smanar]

Hello @DomiStyle do you have some information about shutter calibration on the documentation ?
I have an user with the same kind of shutter, but need a remote for calibration.

ATM I have found some documentation here https://github.com/TuyaInc/tuya_zigbee_sdk

[DomiStyle]

@Smanar Afaik the curtain doesn't support calibration via Zigbee. You need to send the 433 MHz codes from the remote for calibration.

If you don't want to use the remote you could also just use a 433 MHz transmitter instead but since calibration only needs to be done once I don't see any need for it.

[Smanar]

Ha, the remote use 433 Mhz for a shutter that support zigbee ?
Lol strange idea ^^.

[DomiStyle]

Yes, the Zigbee/Z-wave module is just strapped to the curtain motor and communicates with it via a serial port.

The 433 MHz receiver is another way to control it that the included remote uses.

[Smanar]

Ok so @DomiStyle I will be interested by the documentation too ^^.
Just for covering it seem.

• Some device can be calibrated without remote, just with the app, idk if it work without the getaway.
• Not found battery tuya value for covering.

[DomiStyle]

@Smanar Can you add your email address to your GitHub profile or send me a mail to mine so I can send it to you?

Could be, the information in this thread only applies to the Zemismart ZM79E-DT, which doesn't have any commands for calibration according to their documentation.

[Smanar]

Ha :(, I was thinking was a generic documentation for all devices. and I have different tuya devices, some of them are using tuya cluster and other covering cluster.

Too bad, but in any case thx :).

You have used the tuya dev site to contact them ?

[DomiStyle]

@Smanar No, I contacted Zemismart directly and asked them for documentation on the ZM79E-DT.
They sent me the Zigbee specifications for that model as well as the source code for the Zigbee chip.

[Tamozenik1958]

Я смог получить от работы zigbee, теперь он читает позицию и состояние должным образом.

Я также смог перебрать некоторые доступные команды, но все еще не уверен, какие данные мне нужно отправить. Есть ли более быстрый способ отладки отправки команд, кроме перезапуска zigbee2mqtt?

Здравствуйте! Не могу подключить этот мотор к Алисе Яндекс. Кто нибудь может момочь?

[Faustino-ai]

@kirovilya Can please help me a little for my Tuya smart door lock? I am currently stuck at the point after sniffing the device traffic and decrypting them. I currently only have a single CC2531 usb stick so I can't sniff my z2m instances. I read from this post that I can actually write my own command but I do not have enough example to follow (I am very new in programming) since this is a Tuya smart door lock. I've posted my decrypted payload and opened an issue but I am not sure if I am allowed to share the link here. Please do help me a little for me to get started. Thank you.

[kirovilya]

why are you writing this here? and why me? :)
there is an instruction on how to deal with such tuya devices https://www.zigbee2mqtt.io/how_tos/how_to_support_new_tuya_devices.html.
you need to sniff traffic in order to understand what actions in the tuya smart application create zigbee commands.

[Faustino-ai]

why are you writing this here? and why me? :)
there is an instruction on how to deal with such tuya devices https://www.zigbee2mqtt.io/how_tos/how_to_support_new_tuya_devices.html.
you need to sniff traffic in order to understand what actions in the tuya smart application create zigbee commands.

I am writing this here because I was trying to read on how others implement their tuya devices. And I asked you because Koen referred to you on this post when he sees this tuya related topic. Anyway I've done according to the guide, and yes I already sniff the traffic and have the payload ready. The issue I am having now is how to use those payload, which is absent from the guide itself. Thank you

**To make sure I made it clearer, I already have the decrypted payload of my device. (The action is unlock the smart door lock remotely) I created the issue as well if you are so kind to have a look please.

[vlude]

Hi,
Where is the pair button on the zigbee chip?

[nabossha]

@DomiStyle do you still have the documentations and if yes, would you be able to send it to me? thank you very much!