Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature request] Intergrating with E-Byte E800-DTU #4248

Closed
whc2001 opened this issue Sep 2, 2020 · 26 comments
Closed

[Feature request] Intergrating with E-Byte E800-DTU #4248

whc2001 opened this issue Sep 2, 2020 · 26 comments

Comments

@whc2001
Copy link

whc2001 commented Sep 2, 2020

I just bought an E800-DTU (Z2530-485-27) from E-Byte for 160 CNY (~25 USD). As what the model number implies, it is based on the E18 ZigBee module (also from E-Byte), which has an CC2530, communicate via RS485, and has a maximum of 500mW (27dBm) of transmit power. Seems like someone in #2633 and #4128 is also interested in it. After got it and fiddled around, I found that it has a proprietary firmware that is designed to automatically communicate with E-Byte's modules, has proprietary software protocol (confirmed by PCAP, which from the E18-2G4U04B I bought together, that is a clone of the CC2531 USB dongle with sniffer firmware, which worked great), and won't work for our home automation devices. After teardown, I found the E18-2G4Z27SI module, the PA (metal box under the E18 module daughter board) and the RS485 daughter board:
e800-2

I immediately noticed the pin header row on the main daughter board. After poking with multimeter and referring to their E18 module's pin number:
E18-1
E18-2

I am able to figure out the pinout of the debugging port (it has SPI, UART and CC-Debugger at the same time, but seems like flashing only needs the CC port):
E800-E18-dbg

So I tried the Tutorial for CC2530 module since they are both based on CC2530 and serial interface, I don't have CC debugger so I used the flash-cc2531 with RPi method, which I also dumped the proprietary firmware from E-byte (change extension to HEX after downloading):

<Removed since I found out later that the dumped data is completely blank>

The flashing process went smoothly, but after flashing, I am not able to make it work. The serial interface at pin 10 and 11 always has TX=LOW and RX=HIGH, and sending anything from host over serial port will get a 0x00 back. The RS485 module is based on MAX485 or some clone, and has the manual half-duplex switch pin to control the data flow direction, but I am not able to trace where it goes, and it's always HIGH (enables module->host) even when I am sending data over from host. I am pretty much stuck here.

Update: Seems like the duplex pin of MAX485 is inverted by a 74HC14 on the back of the board, which input is related to pin 7 of the module, that also controls the RUN LED at the bottom.

@whc2001
Copy link
Author

whc2001 commented Sep 4, 2020

Tried to flash the stock firmware back, and it still does not come alive. I may have to buy another module and a CC debugger.

@whc2001
Copy link
Author

whc2001 commented Sep 4, 2020

I ripped the module apart, and I am confused about the design: The module pin 12 goes to the base of a transistor, and the collector of that transistor goes to last third of the pin header on the left, so when pin 12 is LOW (according to stock firmware, normally running), pin 5 of the daughter board is HIGH (assume it has pull-up somewhere). Then that pin goes two ways: one is the cathode of the RUN (actually RUN ERR) LED, when it's running the LED should not light up, and this is correct. But it also goes to the 13 of a 74HC14 on the back of the board, which is a schmit trigger with inverter. and the pin 12 of that 74HC14 (corresponding to pin 13 which is input, 12 is output) directly goes to the MAX485 duplex pin. When the pin 5 of the daughter board is HIGH, the pin 12 of the 74HC14 should be LOW, and the MAX485 is in receiving state (host -> module). But I am not sure if the module wants to send something to the host, how will it control the pin 12? I destroyed the E18 module for now so I am not able to try it out, but from my memory the RUN led only light up when it's not ready, and won't light up when the module is transmitting data to the host.

@whc2001
Copy link
Author

whc2001 commented Sep 4, 2020

Cracked open the metal cover of the E18 module, there are two chips inside: one is the expected CC2530, another is a mysterious QFN16 chip that has silkscreen printing as:

SKY
321
7501C

I assume it's an PA chip (the metal can under the daughter board is actually a DC-DC module), but I am not able to find any information in any way about this chip.

@whc2001
Copy link
Author

whc2001 commented Sep 4, 2020

Tried interfacing with the E18 module directly, flashed stock and N-Stack firmware, no activity on serial port at all. Seems like I completely killed it, and now it's going to the dustbin. Although the price and specification looks tempting, I wouldn't recommend purchasing this device unless you are very experienced with CC25XX chipset. Better just go with one of the devices that this project already supported officially.

@whc2001 whc2001 closed this as completed Sep 4, 2020
@bojanpotocnik
Copy link

Have anyone tried using ethernet version? http://www.ebyte.com/en/product-class.aspx?cid=4&pid=101 It looks like it currently uses their cloud.

@bojanpotocnik
Copy link

EBYTE just responded to my question

Hello, what is the difference between E180-DTU (ZG120-ETH) and E800-DTU (Z2530-ETH-27)? Which Zigbee chip is inside E180-DTU? And which ethernet chip? It is possible to support one of these adapters in zigbee2mqtt?

with

E180 is newer model than E800
E180 is Zigbee 3.0,E800 is old version of Zigbee
E180 is EFR32 chip, E800 is CC2530 chip.
And MQTT is said is from OneNet?
E180 supports MQTT protocol

but looking at Koenkk/zigbee-herdsman#168 I see that EFR32 is not yet supported? I think I will order E180 and research their MQTT support.

@whc2001
Copy link
Author

whc2001 commented Oct 16, 2020

Have anyone tried using ethernet version? http://www.ebyte.com/en/product-class.aspx?cid=4&pid=101 It looks like it currently uses their cloud.

I think the -ETH version is just -DTU with a MCU that interfaces ethernet port to UART. The firmware inside wireless module should be the same.

@whc2001 whc2001 reopened this Oct 16, 2020
@whc2001
Copy link
Author

whc2001 commented Oct 16, 2020

EBYTE just responded to my question

Hello, what is the difference between E180-DTU (ZG120-ETH) and E800-DTU (Z2530-ETH-27)? Which Zigbee chip is inside E180-DTU? And which ethernet chip? It is possible to support one of these adapters in zigbee2mqtt?

with

E180 is newer model than E800
E180 is Zigbee 3.0,E800 is old version of Zigbee
E180 is EFR32 chip, E800 is CC2530 chip.
And MQTT is said is from OneNet?
E180 supports MQTT protocol

but looking at Koenkk/zigbee-herdsman#168 I see that EFR32 is not yet supported? I think I will order E180 and research their MQTT support.

I have contacted the customer service of EBYTE (which apparently has a strict management code, I just wrote an honest review that mentions it cannot be used with other devices except their own ZigBee module, not negative review or something, which after he politely requested me to "try to remove" the review (which is not possible from both buyer and seller) or he will face a penalty), and confirmed that this module has its own firmware inside, can be only used with EBYTE's ZigBee module, and they won't disclose hardware design into. The E180 is pretty much the same, which means it's not possible to use them to interface to smart home appliances, until someone reverse engineered the module hardware and transplant the ZStack firmware for it.

@whc2001
Copy link
Author

whc2001 commented Oct 17, 2020

I just bought a CC Debugger clone and another E18-2G4Z27SI module. Hope this time I can at lease dump the original firmware out successfully. Also seems like this chip CAN be used for user applications. Not sure why the ZStack firmware for CC2530 not working.

Datasheet (Chinese): C411295_E18-2G4Z27SI_2019-08-12.PDF

@whc2001
Copy link
Author

whc2001 commented Oct 20, 2020

Bad news: the stock firmware is protected

屏幕截图 2020-10-20 205410

@whc2001
Copy link
Author

whc2001 commented Oct 20, 2020

I erased and flashed the CC2530 firmware to the module, and nothing on UART0 of that module (P1.4/P1.5), which is the E800 used for RS485. But when I connected the UART to another set of pin for UART0 (P0.2/P0.3), I got something on reset:

FE 06 41 80 01 02 00 02 06 03 C3 

Seems like we are progressing here.

@whc2001
Copy link
Author

whc2001 commented Oct 20, 2020

I connected the module to a fresh instance of ZigBee2MQTT, and packet sniffed the serial port, seems like a LOT of communication is going on!

root@raspberrypi:/home/pi/interceptty# interceptty -s 'ispeed 115200 ospeed 115200' -l /dev/ttyUSB0 /dev/ttyVCP0 | interceptty-nicedump
<  ef fe 00 21 01 20             | ▒▒[NUL]![SOH]
>  fe 02 61 01 79 01 1a          | ▒[STX]a[SOH]y[SOH][SUB]
<  fe 00 21 02 23                | ▒[NUL]![STX]#
>  fe 0e 61 02 02 00 02 06 03 90 | ▒[SO]a[STX][STX][NUL][STX][ACK][ETX]▒
>  15 34 01 02 00 00 00 00 da    | [NAK]4[SOH][STX][NUL][NUL][NUL][NUL]▒
<  fe 03 21 08 00 0f 00 25       | ▒[ETX]![BS][NUL][SI][NUL]%
>  fe 03 61 08 00 01 55 3e       | ▒[ETX]a[BS][NUL][SOH]U>
<  fe 03 21 08 00 0f 00 25       | ▒[ETX]![BS][NUL][SI][NUL]%
>  fe 03 61 08 00 01 55 3e       | ▒[ETX]a[BS][NUL][SOH]U>
<  fe 03 21 08 84 00 00 ae       | ▒[ETX]![BS]▒[NUL][NUL]▒
>  fe 06 61 08 00 04 00 08 00 00 | ▒[ACK]a[BS][NUL][EOT][NUL][BS][NUL][NUL]
>  63                            | c
<  fe 03 21 08 63 00 00 49       | ▒[ETX]![BS]c[NUL][NUL]I
>  fe 03 61 08 00 01 00 6b       | ▒[ETX]a[BS][NUL][SOH][NUL]k
<  fe 01 26 04 62 41             | ▒[SOH]&[EOT]bA
>  fe 13 66 04 00 62 10 6e 30 3c | ▒[DC3]f[EOT][NUL]b[DLE]n0<
>  a4 15 62 69 e8 48 9d a4 13 06 | ▒[NAK]bi▒H▒▒[DC3][ACK]
>  c9 c9 33 64                   | ▒▒3d
<  fe 03 21 08 83 00 00 a9       | ▒[ETX]![BS]▒[NUL][NUL]▒
>  fe 04 61 08 00 02 62 1a 17    | ▒[EOT]a[BS][NUL][STX]b[SUB][ETB]
<  fe 03 21 08 2d 00 00 07       | ▒[ETX]![BS]-[NUL][NUL][BEL]
>  fe 0a                         | ▒[LF]
>  61 08 00 08 dd dd dd dd dd dd | a[BS][NUL][BS]▒▒▒▒▒▒
>  dd dd 6b                      | ▒▒k
<  fe 00 27 00 27                | ▒[NUL]'[NUL]'
>  fe 0e 67 00 00 85 50 4f 1f 00 | ▒[SO]g[NUL][NUL]▒PO[US][NUL]
>  4b 12 00 00 00 07 09 00 bb    | K[DC2][NUL][NUL][NUL][BEL][TAB][NUL]▒
<  fe 04 25 05 00 00 00 00 24    | ▒[EOT]%[ENQ][NUL][NUL][NUL][NUL]$
>  fe 01 65 05 00 61 fe 13 45 85 | ▒[SOH]e[ENQ][NUL]a▒[DC3]E▒
>  00 00 00 00 00 0d f2 2f 0d 0c | [NUL][NUL][NUL][NUL][NUL][CR]▒/[CR][FF]
>  6e 0b 08 06 05 04 03 02 01 68 | n[VT][BS][ACK][ENQ][EOT][ETX][STX][SOH]h
<  fe 03 25 4a f2 84 0b 11       | ▒[ETX]%J▒[VT][DC1]
>  fe 13 65 4a 00 84 0b 00 00 00 | ▒[DC3]eJ[NUL]▒[VT][NUL][NUL][NUL]
>  00 00 00 00 00 00 00 00 00 00 | [NUL][NUL][NUL][NUL][NUL][NUL][NUL][NUL][NUL][NUL]
>  00 00 00 b3                   | [NUL][NUL][NUL]▒
<  fe 04 25 05 00 00 00 00 24    | ▒[EOT]%[ENQ][NUL][NUL][NUL][NUL]$
>  fe 01 65 05 00 61 fe 13 45 85 | ▒[SOH]e[ENQ][NUL]a▒[DC3]E▒
>  00 00 00 00 00 0d f2 2f 0d 0c | [NUL][NUL][NUL][NUL][NUL][CR]▒/[CR][FF]
>  6e 0b 08 06 05 04 03 02 01 68 | n[VT][BS][ACK][ENQ][EOT][ETX][STX][SOH]h
<  fe 00 27 00 27                | ▒[NUL]'[NUL]'
>  fe 0e 67 00 00 85 50 4f 1f 00 | ▒[SO]g[NUL][NUL]▒PO[US][NUL]
>  4b 12 00 00 00 07 09 00 bb    | K[DC2][NUL][NUL][NUL][BEL][TAB][NUL]▒
<  fe 05 25 04 00 00 00 00 f2 d6 | ▒[ENQ]%[EOT][NUL][NUL][NUL][NUL]▒▒
>  fe 01 65 04 00 60 fe 0e 45 84 | ▒[SOH]e[EOT][NUL]`▒[SO]E▒
>  00 00 00 00 00 08 f2 e0 a1 05 | [NUL][NUL][NUL][NUL][NUL][BS]▒▒[ENQ]
>  00 00 00 00 71                | [NUL][NUL][NUL][NUL]q
<  fe 05 25 04 00 00 00 00 2f 0b | ▒[ENQ]%[EOT][NUL][NUL][NUL][NUL]/[VT]
>  fe 01 65 04 00 60 fe 0e 45 84 | ▒[SOH]e[EOT][NUL]`▒[SO]E▒
>  00 00 00 00 00 08 2f 04 01 05 | [NUL][NUL][NUL][NUL][NUL][BS]/[EOT][SOH][ENQ]
>  00 00 00 00 e8                | [NUL][NUL][NUL][NUL]▒
<  fe 05 25 04 00 00 00 00 0d 29 | ▒[ENQ]%[EOT][NUL][NUL][NUL][NUL][CR])
>  fe 01 65 04 00 60 fe 10 45 84 | ▒[SOH]e[EOT][NUL]`▒[DLE]E▒
>  00 00 00 00 00 0a             | [NUL][NUL][NUL][NUL][NUL][LF]
>  0d 04 01 05 00 00 01 19 00 00 | [CR][EOT][SOH][ENQ][NUL][NUL][SOH][EM][NUL][NUL]
>  ce                            | ▒
<  fe 05 25 04 00 00 00 00 0c 28 | ▒[ENQ]%[EOT][NUL][NUL][NUL][NUL][FF](
>  fe 01 65 04 00 60 fe 0e 45 84 | ▒[SOH]e[EOT][NUL]`▒[SO]E▒
>  00 00 00 00 00 08 0c 5e c0 05 | [NUL][NUL][NUL][NUL][NUL][BS][FF]^▒[ENQ]
>  00 00 00 00 50                | [NUL][NUL][NUL][NUL]P
<  fe 05 25 04 00 00 00 00 6e 4a | ▒[ENQ]%[EOT][NUL][NUL][NUL][NUL]nJ
>  fe 01 65 04 00 60 fe 0e 45 84 | ▒[SOH]e[EOT][NUL]`▒[SO]E▒
>  00 00 00 00 00 08 6e 04 01 05 | [NUL][NUL][NUL][NUL][NUL][BS]n[EOT][SOH][ENQ]
>  00 00 00 00 a9                | [NUL][NUL][NUL][NUL]▒
<  fe 05 25 04 00 00 00 00 0b 2f | ▒[ENQ]%[EOT][NUL][NUL][NUL][NUL][VT]/
>  fe 01 65 04 00 60 fe 12 45 84 | ▒[SOH]e[EOT][NUL]`▒[DC2]E▒
>  00 00 00 00 00 0c 0b 04 01 00 | [NUL][NUL][NUL][NUL][NUL][FF][VT][EOT][SOH][NUL]
>  04 00 00 02 00 05 02 05 d5    | [EOT][NUL][NUL][STX][NUL][ENQ][STX][ENQ]▒
<  fe 05 25 04 00 00 00 00 08 2c | ▒[ENQ]%[EOT][NUL][NUL][NUL][NUL][BS],
>  fe 01 65 04 00 60 fe 0e 45 84 | ▒[SOH]e[EOT][NUL]`▒[SO]E▒
>  00 00 00 00 00 08 08 04 01 05 | [NUL][NUL][NUL][NUL][NUL][BS][BS][EOT][SOH][ENQ]
>  00 00 00 00 cf                | [NUL][NUL][NUL][NUL]▒
<  fe 05 25 04 00 00 00 00 06 22 | ▒[ENQ]%[EOT][NUL][NUL][NUL][NUL][ACK]"
>  fe 01 65 04 00 60 fe 0e 45 84 | ▒[SOH]e[EOT][NUL]`▒[SO]E▒
>  00 00 00 00 00 08 06 09 01 05 | [NUL][NUL][NUL][NUL][NUL][BS][ACK][TAB][SOH][ENQ]
>  00 00 00 00 cc                | [NUL][NUL][NUL][NUL]▒
<  fe 05 25 04 00 00 00 00 05 21 | ▒[ENQ]%[EOT][NUL][NUL][NUL][NUL][ENQ]!
>  fe 01 65 04 00 60 fe 0e 45 84 | ▒[SOH]e[EOT][NUL]`▒[SO]E▒
>  00 00 00 00 00 08 05 08 01 05 | [NUL][NUL][NUL][NUL][NUL][BS][ENQ][BS][SOH][ENQ]
>  00 00 00 00 ce                | [NUL][NUL][NUL][NUL]▒
<  fe 05 25 04 00 00 00 00 04 20 | ▒[ENQ]%[EOT][NUL][NUL][NUL][NUL][EOT]
>  fe 01 65 04 00 60 fe 0e 45 84 | ▒[SOH]e[EOT][NUL]`▒[SO]E▒
>  00 00 00 00 00 08 04 07 01 05 | [NUL][NUL][NUL][NUL][NUL][BS][EOT][BEL][SOH][ENQ]
>  00 00 00 00 c0                | [NUL][NUL][NUL][NUL]▒
<  fe 05 25 04 00 00 00 00 03 27 | ▒[ENQ]%[EOT][NUL][NUL][NUL][NUL][ETX]'
>  fe 01 65 04 00 60 fe 0e 45 84 | ▒[SOH]e[EOT][NUL]`▒[SO]E▒
>  00 00 00 00 00 08 03 05 01 05 | [NUL][NUL][NUL][NUL][NUL][BS][ETX][ENQ][SOH][ENQ]
>  00 00 00 00 c5                | [NUL][NUL][NUL][NUL]▒
<  fe 05 25 04 00 00 00 00 02 26 | ▒[ENQ]%[EOT][NUL][NUL][NUL][NUL][STX]&
>  fe 01 65 04 00 60 fe 0e 45 84 | ▒[SOH]e[EOT][NUL]`▒[SO]E▒
>  00 00 00 00 00 08 02 01 01 05 | [NUL][NUL][NUL][NUL][NUL][BS][STX][SOH][SOH][ENQ]
>  00 00 00 00 c0                | [NUL][NUL][NUL][NUL]▒
<  fe 05 25 04 00 00 00 00 01 25 | ▒[ENQ]%[EOT][NUL][NUL][NUL][NUL][SOH]%
>  fe 01 65 04 00 60 fe 0e 45 84 | ▒[SOH]e[EOT][NUL]`▒[SO]E▒
>  00 00 00 00 00 08 01 04 01 05 | [NUL][NUL][NUL][NUL][NUL][BS][SOH][EOT][SOH][ENQ]
>  00 00 00 00 c6                | [NUL][NUL][NUL][NUL]▒
<  fe 00 25 50 75                | ▒[NUL]%Pu
>  fe 18 65 50 00 00 09 62 1a 00 | ▒[CAN]eP[NUL][NUL][TAB]b[SUB][NUL]
>  00 dd dd dd dd dd dd dd dd 00 | [NUL]▒▒▒▒▒▒▒▒[NUL]
>  00 00 00 00 00 00 00 0b 57    | [NUL][NUL][NUL][NUL][NUL][NUL][NUL][VT]W
<  fe 05 25 36 0f fc ff fe 00 e4 | ▒[ENQ]%6[SI]▒▒▒[NUL]▒
>  fe 01 65 36 00 52 fe 01 45 cb | ▒[SOH]e6[NUL]R▒[SOH]E▒
>  fe 71                         | ▒q
<  fe 1a 24 02 02 fd ff 00 00 00 | ▒[SUB]$[STX][STX]▒▒[NUL][NUL][NUL]
<  00 00 00 f2 00 00 f2 21 00 01 | [NUL][NUL][NUL]▒[NUL][NUL]▒![NUL][SOH]
<  00 1e 06 00 19 02 02 0b fe 00 | [NUL][RS][ACK][NUL][EM][STX][STX][VT]▒[NUL]
<  e8                            | ▒
>  fe 03 45 b6 00 00 00 f0 fe 01 | ▒[ETX]E▒[NUL][NUL][NUL]▒▒[SOH]
>  64 02 00 67 fe 03 44 80 00 f2 | d[STX][NUL]g▒[ETX]D▒[NUL]▒
>  01 34                         | [SOH]4
<  fe 1a 24 02 02 fd ff 00 00 00 | ▒[SUB]$[STX][STX]▒▒[NUL][NUL][NUL]
<  00 00 00 f2 00 00 f2 21 00 02 | [NUL][NUL][NUL]▒[NUL][NUL]▒![NUL][STX]
<  00 1e 06 00 19 03 02 0b 00 00 | [NUL][RS][ACK][NUL][EM][ETX][STX][VT][NUL][NUL]
<  14                            | [DC4]
>  fe 01 64 02 00 67 fe 03 44 80 | ▒[SOH]d[STX][NUL]g▒[ETX]D▒
>  00 f2 02 37                   | [NUL]▒[STX]7
<  fe 05 25 36 0f fc ff 00 00 1a | ▒[ENQ]%6[SI]▒▒[NUL][NUL][SUB]
>  fe 01 65 36 00 52 fe 01 45 cb | ▒[SOH]e6[NUL]R▒[SOH]E▒
>  00 8f fe 03 45 b6 00 00 00 f0 | [NUL]▒▒[ETX]E▒[NUL][NUL][NUL]▒

And seems like ZigBee2MQTT recognized the device:

Zigbee2MQTT:info  2020-10-20 16:14:48: Logging to console and directory: '/opt/zigbee2mqtt/data/log/2020-10-20.16-14-48' filename: log.txt
Zigbee2MQTT:info  2020-10-20 16:14:48: Starting Zigbee2MQTT version 1.14.4 (commit #654817a)
Zigbee2MQTT:info  2020-10-20 16:14:48: Starting zigbee-herdsman...
Zigbee2MQTT:info  2020-10-20 16:14:51: zigbee-herdsman started
Zigbee2MQTT:info  2020-10-20 16:14:51: Coordinator firmware version: '{"meta":{"maintrel":3,"majorrel":2,"minorrel":6,"product":0,"revision":20190608,"transportrev":2},"type":"zStack12"}'
Zigbee2MQTT:info  2020-10-20 16:14:51: Currently 0 devices are joined:
Zigbee2MQTT:warn  2020-10-20 16:14:51: `permit_join` set to  `true` in configuration.yaml.
Zigbee2MQTT:warn  2020-10-20 16:14:51: Allowing new devices to join.
Zigbee2MQTT:warn  2020-10-20 16:14:51: Set `permit_join` to `false` once you joined all devices.
Zigbee2MQTT:info  2020-10-20 16:14:51: Zigbee: allowing new devices to join.
Zigbee2MQTT:info  2020-10-20 16:14:51: Connecting to MQTT server at mqtt://localhost
^CZigbee2MQTT:error 2020-10-20 16:14:53: Not connected to MQTT server!
Zigbee2MQTT:error 2020-10-20 16:14:53: Cannot send message: topic: 'zigbee2mqtt/bridge/state', payload: 'offline
Zigbee2MQTT:info  2020-10-20 16:14:53: Disconnecting from MQTT server
Zigbee2MQTT:info  2020-10-20 16:14:53: zigbee-herdsman stopped

So, the first challenge of supporting this device, is that the E800 uses another optional pin set of UART0 (P1.4/P1.5) rather than the default pins (P0.2/P0.3).

@whc2001
Copy link
Author

whc2001 commented Oct 20, 2020

I think there are still two challenges: first is that the RS485 half duplex will require a direction control pin to control the data direction, which I have not analyzed which pin is doing that. As I am using standalone module for testing we can ignore this for now.

Another is that the datasheet states that P1.0 and P1.1 controls the internal PA. When you receive you put P1.0 (LNA_EN) on HIGH, and when you transmit you put P1.1 (PA_EN) on HIGH. When doing nothing you put both pins on LOW.

However I just tried a MiJia pushbutton, and seems like it works. I don't have any ZigBee devices that allows me to try coordinator to device communication for now, but seems like device to coordinator communication is fine. So I am not sure the PA_EN and LNA_EN really need to be set to work, or it does not matter.

Zigbee2MQTT:info  2020-10-20 17:01:25: Device '0x00158d00026952e8' joined
Zigbee2MQTT:info  2020-10-20 17:01:25: Starting interview of '0x00158d00026952e8'
Zigbee2MQTT:error 2020-10-20 17:01:25: Not connected to MQTT server!
Zigbee2MQTT:error 2020-10-20 17:01:25: Cannot send message: topic: 'zigbee2mqtt/bridge/log', payload: '{"message":{"friendly_name":"0x00158d00026952e8"},"type":"device_connected"}
Zigbee2MQTT:error 2020-10-20 17:01:25: Not connected to MQTT server!
Zigbee2MQTT:error 2020-10-20 17:01:25: Cannot send message: topic: 'zigbee2mqtt/bridge/log', payload: '{"message":"interview_started","meta":{"friendly_name":"0x00158d00026952e8"},"type":"pairing"}
Zigbee2MQTT:error 2020-10-20 17:01:26: Not connected to MQTT server!
Zigbee2MQTT:error 2020-10-20 17:01:26: Cannot send message: topic: 'zigbee2mqtt/bridge/log', payload: '{"message":"announce","meta":{"friendly_name":"0x00158d00026952e8"},"type":"device_announced"}
Zigbee2MQTT:error 2020-10-20 17:01:26: Not connected to MQTT server!
Zigbee2MQTT:error 2020-10-20 17:01:26: Cannot send message: topic: 'zigbee2mqtt/0x00158d00026952e8', payload: '{"battery":100,"linkquality":110,"voltage":3052}
Zigbee2MQTT:error 2020-10-20 17:01:32: Not connected to MQTT server!
Zigbee2MQTT:error 2020-10-20 17:01:32: Cannot send message: topic: 'zigbee2mqtt/0x00158d00026952e8', payload: '{"action":"single","battery":100,"linkquality":92,"voltage":3052}
Zigbee2MQTT:error 2020-10-20 17:01:32: Not connected to MQTT server!
Zigbee2MQTT:error 2020-10-20 17:01:32: Cannot send message: topic: 'zigbee2mqtt/0x00158d00026952e8', payload: '{"battery":100,"click":"single","linkquality":92,"voltage":3052}
Zigbee2MQTT:error 2020-10-20 17:01:35: Not connected to MQTT server!
Zigbee2MQTT:error 2020-10-20 17:01:37: Not connected to MQTT server!
Zigbee2MQTT:error 2020-10-20 17:01:37: Cannot send message: topic: 'zigbee2mqtt/0x00158d00026952e8', payload: '{"action":"double","battery":100,"linkquality":107,"voltage":3052}
Zigbee2MQTT:error 2020-10-20 17:01:37: Not connected to MQTT server!
Zigbee2MQTT:error 2020-10-20 17:01:37: Cannot send message: topic: 'zigbee2mqtt/0x00158d00026952e8', payload: '{"battery":100,"click":"double","linkquality":107,"voltage":3052}
Zigbee2MQTT:error 2020-10-20 17:01:41: Not connected to MQTT server!
Zigbee2MQTT:error 2020-10-20 17:01:41: Cannot send message: topic: 'zigbee2mqtt/0x00158d00026952e8', payload: '{"action":"hold","battery":100,"linkquality":107,"voltage":3052}
Zigbee2MQTT:error 2020-10-20 17:01:41: Not connected to MQTT server!
Zigbee2MQTT:error 2020-10-20 17:01:41: Cannot send message: topic: 'zigbee2mqtt/0x00158d00026952e8', payload: '{"battery":100,"click":"long","linkquality":107,"voltage":3052}
Zigbee2MQTT:error 2020-10-20 17:01:42: Not connected to MQTT server!
Zigbee2MQTT:error 2020-10-20 17:01:42: Cannot send message: topic: 'zigbee2mqtt/0x00158d00026952e8', payload: '{"action":"release","battery":100,"duration":816,"linkquality":105,"voltage":3052}
Zigbee2MQTT:error 2020-10-20 17:01:42: Not connected to MQTT server!
Zigbee2MQTT:error 2020-10-20 17:01:42: Cannot send message: topic: 'zigbee2mqtt/0x00158d00026952e8', payload: '{"battery":100,"click":"long_release","duration":815,"linkquality":105,"voltage":3052}
Zigbee2MQTT:error 2020-10-20 17:01:45: Not connected to MQTT server!
Zigbee2MQTT:info  2020-10-20 17:01:48: Successfully interviewed '0x00158d00026952e8', device has successfully been paired
Zigbee2MQTT:info  2020-10-20 17:01:48: Device '0x00158d00026952e8' is supported, identified as: Xiaomi MiJia wireless switch (WXKG01LM)
Zigbee2MQTT:error 2020-10-20 17:01:48: Not connected to MQTT server!
Zigbee2MQTT:error 2020-10-20 17:01:48: Cannot send message: topic: 'zigbee2mqtt/bridge/log', payload: '{"message":"interview_successful","meta":{"description":"MiJia wireless switch","friendly_name":"0x00158d00026952e8","model":"WXKG01LM","supported":true,"vendor":"Xiaomi"},"type":"pairing"}

@bojanpotocnik
Copy link

bojanpotocnik commented Oct 21, 2020

Thank you for your insights. If I understand correctly, you have RS-485 version. Last week I ordered E180-DTU (ZG120-ETH), eager to see which interface is used there - hoping for UART using original set of pins + some useful SoC for ethernet. I will probably receive it in the middle of November.

I also ordered Eport Pro-EP20 which could be, in combination with CC2530+CC2591 module, good alternative to achieve E180-DTU (ZG120-ETH) functionality by using more open SDK.

@whc2001
Copy link
Author

whc2001 commented Oct 21, 2020

Thank you for your insights. If I understand correctly, you have RS-485 version. Last week I ordered E180-DTU (ZG120-ETH), eager to see which interface is used there - hoping for UART using original set of pins + some useful SoC for ethernet. I will probably receive it in the middle of November.

I also ordered Eport Pro-EP20 which could be, in combination with CC2530+CC2591 module, good alternative to achieve E180-DTU (ZG120-ETH) functionality by using more open SDK.

Yep the one I got is the E800-485-27 which uses RS485 (although I already destroyed it). It's a pity that E180 uses the the EFR32 chipset that ZStack firmware does not currently support. As what I can see, their DTU products are really meant to use with their own modules since they will have the same firmware. If you want to use it with other brand products then you will have to reflash it with something else.

@whc2001
Copy link
Author

whc2001 commented Oct 21, 2020

I traced and double checked the wires regarding to RS485 duplex switching, and it really goes like this:

Schematic_E800-485_2020-10-21_18-36-05

The direction of MAX485 transceiver is solely controled by the RUN_LED pin of the module (negated by NPN transistor, and negated again by 74HC14D Schmitt inverter). However I don't even think the RUN_LED should light up during device to host transmission. This pin should only be toggled when the software encounter an error for the stock firmware. Anyone have any idea about that?

@whc2001
Copy link
Author

whc2001 commented Oct 21, 2020

Just found that the E18-2G4Z27SI_UserManual-H datasheet mentioned how to modify source code to control PA, and ZStack provided compilation instruction. Maybe I'll try to edit and compile my own ZStack firmware.

@whc2001
Copy link
Author

whc2001 commented Oct 21, 2020

1.Enable PA

HAL\Target\Config\hal_board_cfg.h

#define xHAL_PA_LNA

change to

#define HAL_PA_LNA

*After enabling HAL_PA_LNA, compiling may result in error about segment XDATA is too long. Go to Project Options (right click on project name then options) -> General Options -> Stack/Heap -> Stack XDATA size, should be 0x4D0 or something, decrease it by the required space (should not be too large, in my case just 1 byte).

MAC\Low Level\System\mac_radio_defs.c -> macRadioTurnOnPower()

Code between comments "...during sleep." and "For any RX...", only keep

       /* P1_1 -> PAEN */
      RFC_OBS_CTRL0 = RFC_OBS_CTRL_PA_PD_INV;
      OBSSEL1       = OBSSEL_OBS_CTRL0;
      
      /* P1_0 -> EN (LNA control) */
      RFC_OBS_CTRL1 = RFC_OBS_CTRL_LNAMIX_PD_INV;
      OBSSEL0       = OBSSEL_OBS_CTRL1;

MAC\High Level\mac_pib.c

Field before "/* phyTransmitPower */", change to

#if defined (HAL_PA_LNA)
  27,                                          /* phyTransmitPower */
#else
  0,
#endif

2. Switch UART0 from DMA mode to ISR mode (for RS485 direction control)

HAL\Target\Config\hal_board_cfg.h

Change both to DMA=0 ISR=1

#if defined HAL_SB_BOOT_CODE
#define HAL_UART_DMA  0
#define HAL_UART_ISR  1
#else
#define HAL_UART_DMA  0
#define HAL_UART_ISR  1
#endif
#define HAL_UART_USB  0

HAL\Target\CC2530ZNP\Drivers\hal_dma.c

Comment the two lines about HalUARTIsrDMA

HAL_ISR_FUNCTION( halDmaIsr, DMA_VECTOR )
{
  HAL_ENTER_ISR();

  DMAIF = 0;

  if (ZNP_CFG1_UART == znpCfg1)
  {
    if (HAL_DMA_CHECK_IRQ(HAL_DMA_CH_TX))
    {
      //extern void HalUARTIsrDMA(void);        // <--Comment!!!
      //HalUARTIsrDMA();        // <--Comment!!!
    }
  }
#if (defined HAL_SPI) && (HAL_SPI == TRUE)
...

3. Switch UART0 from P0.2/P0.3 to P1.4/P1.5

HAL\Target\CC2530ZNP\Drivers\hal_uart.c -> _hal_uart_isr.c -> HalUARTInitISR()

Comment all but the line setting bit 0 of PERCFG to 1 in the block below:

//#if (HAL_UART_ISR == 1)
  //PERCFG &= ~HAL_UART_PERCFG_BIT;    // Set UART0 I/O location to P0.
//#else
  PERCFG |= HAL_UART_PERCFG_BIT;     // Set UART1 I/O location to P1.      <--Only keep this line!!!
//#endif

4. Toggle RUN_LED (P1.3) according to UART state, also disable NWK_LED since we are not using it

HAL\Target\Config\hal_board_cfg.h

Change LED1 definition to P1.2 active low, modify code as below.

/* ------------------------------------------------------------------------------------------------
 *                                       LED Configuration
 * ------------------------------------------------------------------------------------------------
 */

...

/* 1 - Green */
#define LED1_BV           BV(2)
#define LED1_SBIT         P1_2
#define LED1_DDR          P1DIR
#define LED1_POLARITY     ACTIVE_LOW

Add some code to HAL_BOARD_INIT() in order to initialize RUN_LED P1.3, and turn off NWK_LED P1.2. Pay attention to the lines with comment "Add: ..."

#define HAL_BOARD_INIT() st                                      \
(                                                                \
...
  /* set direction for GPIO outputs  */                          \
  LED1_DDR |= LED1_BV;                                           \
  HAL_TURN_OFF_LED1();  /* Add: Not using NWK_LED */             \
...
  /* configure tristates */                                      \
  P0INP |= PUSH2_BV;                                             \
                                                                 \
  /* Add: RS485 direction pin P1.3 setup */                      \
  P1SEL &= ~0x08;       /* Add: P1.3 manually control */         \
  P1DIR |= 0x08;        /* Add: P1.3 output */                   \
  P1_3 = 0;             /* Add: P1.3 default low (receive) */    \
                                                                 \
  /* setup RF frontend if necessary */                           \
...

HAL\Target\CC2530ZNP\Drivers\hal_uart.c

#include "hal_board_cfg.h"
#include "hal_defs.h"
#include "hal_types.h"
#include "hal_uart.h"
#include "OnBoard.h"    // Add this line for MicroWait()

HAL\Target\CC2530ZNP\Drivers\hal_uart.c -> _hal_uart_isr.c -> halUartTxIsr

Transmitting to host = H Receiving from host = L

Add some code (according to this article). Pay attention to the lines with comment "Add: ..."

HAL\Target\CC2530ZNP\Drivers\hal_uart.c -> _hal_uart_isr.c

/*********************************************************************
 * LOCAL VARIABLES
 */

static uartISRCfg_t isrCfg;
static uint8 isSending; // Add: for signalling if whole packet is finished

HAL\Target\CC2530ZNP\Drivers\hal_uart.c -> _hal_uart_isr.c -> HalUARTWriteISR

uint16 HalUARTWriteISR(uint8 *buf, uint16 len)
{
  uint16 cnt;
  
  // Enforce all or none.
  if (HalUARTTxAvailISR() < len)
  {
    return 0;
  }
  
  U1CSR &= ~0x40;     // Add: Disable RX
  P1_3 = 1;     // Add: 485 Transmitting mode (RUN_LED = 1)
  isSending = 1;        // Add: Set sending flag
  MicroWait(6000);      // Add: Wait for some time
  
  for (cnt = 0; cnt < len; cnt++)
  {
    isrCfg.txBuf[isrCfg.txTail] = *buf++;
    isrCfg.txMT = 0;

    if (isrCfg.txTail >= HAL_UART_ISR_TX_MAX-1)
    {
      isrCfg.txTail = 0;
    }
    else
    {
      isrCfg.txTail++;
    }

    // Keep re-enabling ISR as it might be keeping up with this loop due to other ints.
    IEN2 |= UTXxIE;  
  }
  
  isSending = 0;        // Add: Clear sending flag

  return cnt;
}

HAL\Target\CC2530ZNP\Drivers\hal_uart.c -> _hal_uart_isr.c -> halUartTxIsr

#if (HAL_UART_ISR == 1)
HAL_ISR_FUNCTION( halUart0TxIsr, UTX0_VECTOR )
#else
HAL_ISR_FUNCTION( halUart1TxIsr, UTX1_VECTOR )
#endif
{
  if (isrCfg.txHead == isrCfg.txTail)
  {
    IEN2 &= ~UTXxIE;
    isrCfg.txMT = 1;
    
    if(!isSending)      // Only after HalUARTWriteISR() finished writing
    {
      MicroWait(6000);    // Add: Wait for some time
      U1CSR |= 0x40;      // Add: Enable RX
      P1_3 = 0;   // Add: 485 Receive mode (RUN_LED = 0)
    }
  }
  else
  {
    U1CSR &= ~0x40;     // Add: Keep RX disabled
    P1_3 = 1;     // Add: Keep 485 in transmitting mode (RUN_LED = 1)

    UTXxIF = 0;
    UxDBUF = isrCfg.txBuf[isrCfg.txHead++];

    if (isrCfg.txHead >= HAL_UART_ISR_TX_MAX)
    {
      isrCfg.txHead = 0;
    }
  }
}

@whc2001
Copy link
Author

whc2001 commented Oct 21, 2020

Tested the 2G4Z27SI along with the CC2531 USB stick with MiJia pushbutton, it appears that the 2G4Z27SI does not have a significant improvement regarding to signal reception distance (even a little worse in some cases). I wonder if it's because the LNA is not working correctly.

@github-actions
Copy link
Contributor

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 7 days

@github-actions github-actions bot added the stale Stale issues label Nov 21, 2020
@whc2001
Copy link
Author

whc2001 commented Nov 23, 2020

Contacted EByte again and they still does not want to disclose any design detail about E800. Gonna buy another one and do some testing with stock firmware. Now the only thing that's uncertain is about the relation of RS485 direction and RUN LED.

@github-actions github-actions bot removed the stale Stale issues label Nov 24, 2020
@whc2001
Copy link
Author

whc2001 commented Nov 25, 2020

The new unit arrived, and sure enough, the RUN LED blinks when the unit is sending data to the host. Just updated the ZStack code modify tutorial for RS485 direction switch. Gonna rip the new E800 apart and flash the firmware later.

@whc2001
Copy link
Author

whc2001 commented Nov 29, 2020

Measured RUN_LED and TX pin on original firmware. Not sure why the logic seems to be inverted. One useful information is that seems like the RUN_LED pin toggles ~5.5ms before and after transmitting. Modifying the ZStack code corresponding to that.

e800_1

@whc2001
Copy link
Author

whc2001 commented Nov 30, 2020

Note for myself: 7P header from daughter board to main board:

MODULE_BAUD_RST_BTN P1.7
/MODULE_NWK_LED P1.2(Inverted, H=In Network L=No Network)
MODULE_RX P1.4
MODULE_TX P1.5
/MODULE_RUN_LED P1.3(Inverted, H=Normal L=Error / 485 Transmitting)
VCC
GND

@whc2001
Copy link
Author

whc2001 commented Dec 1, 2020

\ Seems like it worked!!! /

Zigbee2MQTT:info  2020-12-01 14:31:01: Logging to console and directory: '/opt/zigbee2mqtt/data/log/2020-12-01.14-31-01' filename: log.txt
Zigbee2MQTT:info  2020-12-01 14:31:02: Starting Zigbee2MQTT version 1.14.4 (commit #654817a)
Zigbee2MQTT:info  2020-12-01 14:31:02: Starting zigbee-herdsman...
Zigbee2MQTT:info  2020-12-01 14:31:06: zigbee-herdsman started
Zigbee2MQTT:info  2020-12-01 14:31:06: Coordinator firmware version: '{"meta":{"maintrel":3,"majorrel":2,"minorrel":6,"product":0,"revision":20190619,"transportrev":2},"type":"zStack12"}'
Zigbee2MQTT:info  2020-12-01 14:31:06: Currently 1 devices are joined:
Zigbee2MQTT:info  2020-12-01 14:31:06: 0x00158d00026952e8 (0x00158d00026952e8): WXKG01LM - Xiaomi MiJia wireless switch (EndDevice)
Zigbee2MQTT:info  2020-12-01 14:31:06: Zigbee: disabling joining new devices.
Zigbee2MQTT:info  2020-12-01 14:31:06: Connecting to MQTT server at mqtt://localhost
Zigbee2MQTT:info  2020-12-01 14:31:06: Connected to MQTT server
Zigbee2MQTT:info  2020-12-01 14:31:06: MQTT publish: topic 'zigbee2mqtt/bridge/state', payload 'online'
Zigbee2MQTT:info  2020-12-01 14:31:06: MQTT publish: topic 'zigbee2mqtt/0x00158d00026952e8', payload '{"battery":100,"linkquality":106,"voltage":3022}'
Zigbee2MQTT:info  2020-12-01 14:31:06: MQTT publish: topic 'zigbee2mqtt/bridge/config', payload '{"commit":"654817a","coordinator":{"meta":{"maintrel":3,"majorrel":2,"minorrel":6,"product":0,"revision":20190619,"transportrev":2},"type":"zStack12"},"log_level":"info","network":{"channel":11,"extendedPanID":"0xdddddddddddddddd","panID":6754},"permit_join":false,"version":"1.14.4"}'
Zigbee2MQTT:info  2020-12-01 14:31:10: MQTT publish: topic 'zigbee2mqtt/0x00158d00026952e8', payload '{"action":"single","battery":100,"linkquality":135,"voltage":3022}'
Zigbee2MQTT:info  2020-12-01 14:31:10: MQTT publish: topic 'zigbee2mqtt/0x00158d00026952e8', payload '{"battery":100,"click":"single","linkquality":135,"voltage":3022}'
Zigbee2MQTT:info  2020-12-01 14:31:12: MQTT publish: topic 'zigbee2mqtt/0x00158d00026952e8', payload '{"action":"double","battery":100,"linkquality":130,"voltage":3022}'
Zigbee2MQTT:info  2020-12-01 14:31:12: MQTT publish: topic 'zigbee2mqtt/0x00158d00026952e8', payload '{"battery":100,"click":"double","linkquality":130,"voltage":3022}'
Zigbee2MQTT:info  2020-12-01 14:31:16: MQTT publish: topic 'zigbee2mqtt/0x00158d00026952e8', payload '{"action":"triple","battery":100,"linkquality":135,"voltage":3022}'
Zigbee2MQTT:info  2020-12-01 14:31:16: MQTT publish: topic 'zigbee2mqtt/0x00158d00026952e8', payload '{"battery":100,"click":"triple","linkquality":135,"voltage":3022}'

Some problems:
1. LNK_LED does not work (for stock firmware it dims when joined into a network, not sure how to implement)
2. UART_BAUD_RESET button does not work and pushing it would cause unknown effect (do ZStack and zigbee2mqtt really use button for anything?)
3. Seems like if the E800 is accidentally power cycled while zigbee2mqtt is running, it will not connect back to devices and all operation of devices have no effect until you restart zigbee2mqtt (is it designed to be that, or are there some problem with the firmware?)
4. Working distance (or actually, are the PA and LNA really working) is unknown and waiting for test
5. zigbee2mqtt will randomly fail to start with the error message below (only one data burst according to TX/RX indicator on E800, there will be at least three data bursts when it starts successfully)

Zigbee2MQTT:error 2020-12-01 23:39:07: Error while starting zigbee-herdsman
Zigbee2MQTT:error 2020-12-01 23:39:07: Failed to start zigbee
Zigbee2MQTT:error 2020-12-01 23:39:07: Exiting...
Zigbee2MQTT:error 2020-12-01 23:39:07: Error: SRSP - SYS - osalNvRead after 6000ms
    at Timeout._onTimeout (/opt/zigbee2mqtt/node_modules/zigbee-herdsman/dist/utils/waitress.js:46:35)
    at listOnTimeout (internal/timers.js:554:17)
    at processTimers (internal/timers.js:497:7)

I am aware that this issue is kept open for way too long, so I'm gonna close it for now, and later refine the writeup of firmware modify steps a bit and put it along the compiled firmware into a new repository. Also I think tests are still needed, since I only have the E800 and a MiJia pushbutton. Anyone have this please try it if you'd like, and look for any problems. Thanks everyone for the supporting process.

@whc2001 whc2001 closed this as completed Dec 1, 2020
@whc2001
Copy link
Author

whc2001 commented Feb 5, 2021

Anyone willing to test it here is the compiled HEX file: https://github.com/whc2001/zigbee2mqtt_E800

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants