Tuya Zigbee USB Range Extender / USB Dongle Signal Repeater (Tuya SKU: "RP280" / Zigbee ID: "TS0207")

[Hedda]

Tuya is apparently making a 10 dBm "Zigbee 3.0 Range Extender" / "Zigbee 3.0 Signal Repeater" (Tuya SKU: "RP280") described as Zigbee Router device in a USB dongle/stick format, which at least on paper looks interesting both as it is and more interesting if it can be reflashed?

https://zigbee.blakadder.com/Tuya_TS0207.html

Zigbee 3.0 Signal Repeater Model TS0207 manufactured by Tuya

Zigbee ID: "TS0207"; "_TZ3000_m0vaazab"; "FNB54-WTS08ML1.0"; "_TZ3000_ufttklsz"; "_TZ3000_5k5vh43t"

This RP280/TS0207 is sold as a "signal repeater"/"signal booster"/"range extender" for around $10 under different brand names other than Tuya; including LoraTap, Lonsonho, SMARSECUR, Marmitek, Yueyang, Mahnoor, Skyverty, Legefirm, Hesupy, Irfora, GOSER, etc..

Think it is based Silabs EFR32MG13 / EFR32MG13P732HI chip, same as Tuya TYZS1L module, if so should have 512KB Flash storage and 64KB RAM memory? Note that the more common Tuya TYZS6 module based on EFR32MG1B132 only has 256KB Flash storage and 32KB RAM.

https://developer.tuya.com/en/docs/iot/zigbeetyzs1lmodule?id=K989rjcbpt4cx

https://developer.tuya.com/en/docs/iot/light-design?id=K95afopz8waah

https://usermanual.wiki/Hangzhou-Tuya-Information-Technology/TYZS1L-4315271.pdf

What is strange about the design is that this Zigbee USB dongle/stick does not appear to feature any physical button(?), and instead, it looks to only be configured via a mobile app, including the simple task of putting it in pairing mode. Reading its description the dongle/stick features either WiFi(?) or Bluetooth(?) which I understand is solely used to control paring via a mobile app, (including Touchlink pairing?). Regardless it sounds interesting to have a Zigbee Router configurable via an app.

https://translate.google.com/translate?hl=&sl=auto&tl=en&u=https%3A%2F%2Fforum.iobroker.net%2Ftopic%2F37313%2Fzigbee-repeater-in-iobroker-einbinden

Home Assistant's ZHA users report that it already works with ZHA (and zigpy), but most of the sellers on Aliextress state in their descriptions that it does not work without a Tuya gateway and is not compatible with a third-party Zigbee coordinator/hub/gateway.

https://community.home-assistant.io/t/tuya-zigbee-signal-repeater-working-with-zha-and-conbee-2/249329

Zigbee2MQTT and deCONZ/Phoscon users does however say that they have not yet gotten it to work:

dresden-elektronik/deconz-rest-plugin#4175

Koenkk/zigbee2mqtt#4104

You can either buy just the USB stick/dongle and provide your own USB charger (5V USB power supply) or buy it with such a USB charger:

https://www.aliexpress.com/i/1005001459823340.html

https://www.aliexpress.com/item/4001230151655.html

https://www.aliexpress.com/i/1005001274714963.html

https://www.aliexpress.com/item/1005002441359324.html

https://www.aliexpress.com/i/1005002526017479.html

https://www.amazon.com/Extender-Protable-Amplifier-Gateway-Repeater/dp/B08MWBKK4P

https://www.amazon.com/Repeaters%EF%BC%8CKKmoon-Amplification-Transmitters-Enhancement-Compatible/dp/B08R3QC9X6/

[Hedda]

https://forum.iobroker.net/topic/37313/zigbee-repeater-in-iobroker-einbinden

[Hedda]

I wondering id they is having one "compact PCB antenna" and how good the RF part is working in the real.
Its more or less the format as ELibs USB dongle but i think they dont have any USB-serial chip on it then its not needed.

I have only seen some user using it and the LIQ was not one high light but i think what you can expecting of the device.

Any internal photos of FCC link ??

Chip CC2530 ?

@MattWestb Antenna component look to be part that says "UART"(R) and "20B00097B" or "208000978" or something like that?

Since it claims to support Zigbee 3.0 I do not think that it uses CC2530 as that chip office only support Z-Stack Home 1.2

Someone posted that the device is marketed to have a 10 dBm power amplifier.

It could be a CC26xx series device like CC2640 or CC2650 as needs to have Bluetooth or Wi-Fi too if config is via a mobile phone?

However, I do not think that any chip in TI CC26xx family incorporates a USB to serial bridge/converter if that also is needed?

[MattWestb]

Way do you need on WiFI / BT interface on the device ?
You can triggering leave / joining with power on / off sequence and then its "living" in the network without problems and dont need ans attention its only doing the routing in the mesh.

Can being one EFR32MG1 but no easy saying then not having better photos of the ship or layout.

UANT is somthing with antenna but dont see how is being made can being one ceramic one or PCB.

By the way i have putting one future request in bellows for implanting joining as router with CLI then its possible joining as (NS)ED and forming network as coordinator but router missing and can being used on all devices that is running EZSP also old EM35X with USB can being user with on USB charger.

[Hedda]

Way do you need on WiFI / BT interface on the device ?

I understand this RP280 has no buttons and Tuya choose to control the configuration of it using an app on your phone via BLE.

I believe the app not only allows you to active joining / leaving but also allow you to configure the name of the device on its side.

[dmulcahey]

These have been proven to cause network stability issues. They black hole traffic from non tuya devices under certain circumstances. I have helped a couple folks on the forums that had issues that appeared to be caused by these.

[MattWestb]

I have seen some user having strange problems 2.
And i think the concept with very minimalism hardware (antenna part) is not going well and cant compensating for the bad hardware design (and perhaps software 2).

Better baying one good light bulb or outlet (but not OSRAM ones).

Thanks for feedback David !!

[Adminiuga]

that's kind of an asshole move on Tuya's side

[MattWestb]

Trying not being one banner but what i can see is the device not FCC or CE certificated and only that shall making it being labeled with one warning that is not allowed to being used in US and EC.

Device with low power output is not so critical and can working well without RF shield but if using higher RF power output it shall being shielded and having FCC / CE certificate or you is getting one "Sonof DIY" product quality.

I can agree that is looks nice but its little baying one 13" tablet that is phone enabled and using it without headset and using it like on telephone its not practical and don working well but its have one great price tag and can dong many great things but is nearly useless for doing telephone calls with.

I still missing my last Nokia GSM that was fitting inside one cigarette package after 5 ciggs was removed and all newer is looking like giant monsters compared with it and the most important it was possible using as one telephone :-)))

[Hedda]

They black hole traffic from non tuya devices under certain circumstances.

If done intentionally then would think that violate Zigbee 3.0 certification? Strange move now Tuya is certifying new devices:

https://zigbeealliance.org/zigbee_products/?product_type=certified_product&se=tuya

[MattWestb]

They is one of the flag members in the alliance and i think because they is beating IKEA then its coming to spamming the market with devices.

[nick9one1]

I bought a couple of these thinking they would be increase my zigbee link quality. I only have battery powered devices, so no repeaters until I plugged these in.

before I installed;

after installing and pairing with zigbee2mqtt..

[nick9one1]

@dmulcahey
what was your fix for issues caused by the Tuya repeaters?

[zimonth]

If I want to have SMA-connector(s) soldered to that same Zigbee RP280 repeater, in which contacts wires should be connected?
I have bought 3 of these. They do extend zigbee signals, but rather quickly when distance is greater, the signal level goes too low and the connection is lost. I wonder, if it could be a good hack to get external WiFi-antenna (or two) connected to that repeater.

I assume somewhere in there "UANT 20B00097B" component. But should that component be disconnected first? There is three connectors there. Two of them go through resistors. One connector has white dot.

[My Zigbee coordinator is Tuya Zigbee-Wifi (Tuya Zigbee 3.0 Smart Wifi gateway), and devices are several thermometers (Tuya), couple of power sockets (Lidl) and one water-level warning subdevice, and then those repeaters (zigbee routers).]

[MattWestb]

Do you have one good photo of the other side so its possible see if its one PCB antenna integrated and how it being made ?
If the chell is having one antenna connected to the 3 connectors its very likely only using them but must finding witch is used for what.

The chip RF in and output is in the underside and going with small components (3 i serial and 4 to ground) to the upper connector near the "97B" and the lowe connector is going to ground with (likely) one resistor and the muddle looks having one extra matching component for one no standard 50 Ohm antenna.

[zimonth]

Yes, here

[MattWestb]

OK i cant see any PCB traces so not knowing if PCB antenna in the lower art or not and the connectors is not going thru the PCN :-(
Is it one antenna inside the plastic cap ?

[zimonth]

Yes I think the antenna is inside that black rectangular flat plastic cap. Three connections goes into it.

[MattWestb]

Its the normal but never 110% sure. Sirlabs reference design looks like this https://github.com/MattWestb/IKEA-TRADFRI-ICC-A-1-Module#new-ikea-tr%C3%A5dfri-markus-ezsp-module.
The problem is that for getting optimal signal the interface shall having 50 Ohm and the internal antenna can being more o lesser and the component is tuned for that.
On the Sirlabs you can see for PB is 6 components being used and for external 4 (cna being some more under the scheeld but the math is the same).
If the antenna is inside the PCB you must cutting the trace (red) so its being disconnected and using external RF (yellow) and GND (green).

[zimonth]

Took that sticker off. Under was chip "EFR32 MG13P732HI 20330000FY"

[MattWestb]

You have 3 times more flash as my "Billy EZSP" :-((

Can you doing one photo of the antenna part with the same light so its possible see the PCB trace ?

[MattWestb]

Its looks like tuya standard components (for MG13P) is for the RF is: S(eriel), P(arallel), S, P, S and one not populated P for both PCB and external antennas if looking on photos of the modules like PCB https://fccid.io/2ANDL-TYZS5/Internal-Photos/Int-Photos-4266121 and IPEX (not photo) https://solution.tuya.com/hardware/detail/63008.

I think cutting the PCB trace by my red marking and connecting the cable GND and RF in the PCB tracs is the right for your device.

PS: MG21 is having one other RF tuning setting so can looking on them for comparing with your device.

[zimonth]

ok, thanks. I will try it when external antennas and 1m RP-SMA cables come from China. Maybe even before I try to measure some resistances with multimeter to figure it out more.
One more photo of both sides in same picture, but the resolution is not much better that previous. Should have microscope and camera in it to have better.

[MattWestb]

Ithink (= not knowing) that is not needed cutting the PCB trace only need connecting GND to the lower "contact" and the upper to the RF signal contact letting the 2 black is resistors that is very likely very low value and you dont need destroying the PCB.

Is it something metal in the plastic cap that can acting as antenna (its looks its bo PCB antenna on the board only contacts for it) ?

[MattWestb]

OPS is the plate "UANT" one antenna module that is glued on the PCB ?
I was thinking it was one glued labeling tape on the board and not one component but i think im being wrong !!

[zimonth]

No, I think it is plastic. And yes glued on the PCB. Maybe and I asume wire inside it acting as antenna. If I get röntgen image of it later, I will post it :P
Fortunately it is rather cheap, and I have two more, so can experience abit.

[MattWestb]

YES PLEAS !!!

OK then its cutting (or taking the 2 black resistor away and cutting the upper one) and connecting the GND and RF on the PCB trace as on my drawing so the plastic is disconnected and you is taking the signal before it.

[MattWestb]

Some things for soldering on the PCB. The red aria is best not having cable around then the crystal is on the other side and must being free from interference so the cable not going up, make it going down (from the picture viue).
Cutting and / or taking the resistors away (Strong red).
Scratching the lack from the trace and souldring the cable on the fine green and yellow PCB trace.

Perhaps you need one microscope then its very small parts and use much flux the soldering or its not working.

[monxas]

Does anyone know how to reset it? I had it working with my zigbee network but decided to start over. Now I don’t see any way to put it into pairing mode again.

[zimonth]

Plugging it in and out a few times resets it and puts it in a pairing mode, like "lighting device" in this:
https://support.tuya.com/en/help/_detail/K9mch3ca38pvz

[dangsithi]

Have you successfully expanded the antenna for it?

[codyc1515]

What's the consensus on these? Do they work well now?

[Hedda]

What's the consensus on these? Do they work well now?

It only works well if flash other firmware via JTAG and J-Link.

As mentioned above the default firmware is ships with is is a black hole for some messages and as such very bad to have on your Zigbee network.

[darkcheater]

could you please link some guide on how to flash these? They are useless with the original firmware and I don't want to throw them away.

[Hedda]

could you please link some guide on how to flash these? They are useless with the original firmware and I don't want to throw them away.

There is no step-by-step guide available for this specific EFR32 based product, and FYI, you can not simply flash them directly via their USB, however there are many options and plenty of information available about programming/flashing any Silicon Labs based EFR32 (and older Silabs EMF32) products via different debugger (debug probe) programmer via SWD, JTAG, C2 interface pins/pads available via solderpads on the circuit board or the pins on the actual chips (as well as adding power and grounding via pads/pins) :

• https://www.silabs.com/developers/mcu-programming-options
  • https://wiki.segger.com/Target_Interface_SWD
  • https://wiki.segger.com/Target_Interface_JTAG
  • https://community.silabs.com/s/article/jtag-and-c2-debug-interfaces?language=en_US

So first note that you need to have/get, buy or borrow an EFR32 compatible debugger (debug probe) to use as an MCU flash programmer, which is not exactly cheap, and which exact debugger you should buy if you do not already own any EFR32 compatible any debugger programmers / debug probes then you will need to decide whether or not want to be able to reuse the that debugger (debug probe) adapter for other non-Silabs MCU devices as well and what budget you want to spend on it.

• While tested the best value debugger for getting started with EFR32 is probably Silabs new Simplicity Link Debug Adapter board (SI-DBG1015A / BRD1015A) that sounds like it might also work (as it should actually be a Segger J-Link debug probe licensed product) -> https://www.silabs.com/development-tools/wireless/simplicity-link-debugger
• The most expensive but also the most flexible option is a Segger J-Link debug probes that come in different models -> https://www.segger.com/products/debug-probes/j-link/
  • There are also several J-Link clones on the market which may or may not work but if looking at clones then a better tip is that Segger have an official model called "J-Link EDU Mini" meant for non-commercial/educational use so is a little limited and slower but has benifit of not being too expensive and nice to start with if plan on reusing with other types of non-Silabs MCU devices as well, but note the major downside with that J-Linl EDU Mini model is they only offer 3-years of updates to it and then it can not be updated more to be used with newer software -> https://wiki.segger.com/Debug_Probes_-_J-Link_%26_J-Trace
• Alternativly can use Silicon Labs EFM32 Starter Kit(s) as an external debugger -> https://community.silabs.com/s/article/using-an-efm32-starter-kit-as-an-external-debugger?language=en_US
• The least expensive will be any JTAG debugger compatible with EFR32 but then will need to use unofficial software tools (like example pyOCD or OpenOCD) for flashing, which are generally not recommended for newer EFR32 -> https://www.google.com/search?q=jtag+AND+debugger+efr32

If you instead want to use a standard JTAG/SWD debugger and MCU flash programmer that is not officially compatible with Silicon Labs Simplicity Studio Software and Segger's J-Link Commander then you might need to use generic third-party flash programmer software instead (like example pyOCD or OpenOCD), but those can be very tricky to get working niche targets such as newer EFR32 based radio SoCs.

Anyway, Silabs has several generic guides for EFR32 (that also applies to older EMF32), however if you want to use the official Simplicity Studio Software and/or Simplicity Commander stand-alone as flash programmer tool for flash programming the MCU then you need either Segger J-Link or other officially compatible Silicon Labs 32-bit debugger/programmer. Note also that these guides assume that you already connected all the correct pins to a debug probe in the first place:

https://community.silabs.com/s/article/debugging-an-efm32-product-on-a-custom-board?language=ko

https://siliconlabs.my.site.com/community/s/article/kba-bt-1210-connect-custom-board-to-simplicity-studio-using-jtag-swd-x?language=sv

https://docs.silabs.com/simplicity-studio-5-users-guide/latest/ss-5-users-guide-building-and-flashing/flashing#flash-programmer

Silabs AN958 has more details which can help you figure out what pins are needed:

https://www.silabs.com/documents/public/application-notes/an958-mcu-stk-wstk-guide.pdf

(detailed pinout can usually be in the data sheet / user manual of the radio module if sold for that purpose but that is not the case here).

Find more resources and specific questions about flashing then recommend posting in Silabs community forums:

https://community.silabs.com/s/?language=en_US

[darkcheater]

Thank you for your detailed answer. I read through a lot of documentation now and I flashed my STlink v2 so I have a JLink now.
As far as I understood, the Tuya repeater's EFR32MG13 can be flashed via SWD because the pins CLK and IO are marked on the PCB.
Where do I get the firmware (router firmware) from and if I have it, with which tool can I flash the repeater with my JLink?
Sorry, I don't have experience with these MCUs.
Edit: I found this: https://github.com/grobasoz/zigbee-firmware/tree/master/EFR32%20Series%201
Which firmware do I need? :)

[Hedda]

I read through a lot of documentation now and I flashed my STlink v2 so I have a JLink now.
...
with which tool can I flash the repeater with my JLink?

Again, normally you would use Silabs own official Simplicity Studio Software and/or Simplicity Commander for EFR32 based MCU chips:

• https://www.silabs.com/developers/mcu-programming-options
  • https://www.silabs.com/developers/simplicity-studio
  • https://docs.silabs.com/simplicity-studio-5-users-guide/latest/ss-5-users-guide-building-and-flashing/flashing#flash-programmer
  • https://www.silabs.com/documents/public/software/pyprogrammer.zip
  • https://www.silabs.com/documents/public/user-guides/ug162-simplicity-commander-reference-guide.pdf

As you can read there Silicon Labs also have a packaged "Jlink Python Programming GUI Tool" for Segger JLink over C2 or SWD interface:

https://www.silabs.com/documents/public/software/pyprogrammer.zip

If truely can act as a J-Link debug programmer that is compatible with EFR32MG13P/EFR32MG13 then can alternativly use the more generic J-Link software from Segger (but note that like with the above might need to try to use and older version if the software does not detect your J-Link clone as a Segger made J-Link debug probe), ex:

https://www.segger.com/downloads/jlink/#J-LinkSoftwareAndDocumentationPack

https://wiki.segger.com/Silicon_Labs_EFR32xG1x

https://community.silabs.com/s/article/update-efr32-firmware-using-j-link-on-raspberry-pi-command-line-x?language=en_US

Also see instructions how to unlock a bricked EFR32 using J-link commander:

https://community.silabs.com/s/article/unlock-a-bricked-efr32-or-efm32pg-jg-series-1-device-using-j-link-commander?language=en_US

By the way, found that now that Tuya does also have some development information on how to flash their EFR32 based modules/products:

https://developer.tuya.com/en/docs/iot/burn-and-authorize-zstyzs-series-modules?id=Ka8x29inhcx8d

[Hedda]

Where do I get the firmware (router firmware) from?
...
Which firmware do I need? :)

@darkcheater as far as I know there are no existing firmware Zigbee Router builds/images for that or any other other EFR32MG13P (EFR32MG13 Series 1) based device and even less with the same pin mapping. Regardless, that whole general discussion or request about building and releasing Zigbee Router firmware images as dedicated Zigbee signal repeater / Zigbee range extender for the community is probably something that is better discussed in these other repositories in the existing issue trackers or as new issues, see these:

grobasoz/zigbee-firmware#24

grobasoz/zigbee-firmware#33

darkxst/silabs-firmware-builder#15

What firmware image to flash is really a seperate and much more complicated question than how-to flash it, because as far as I know no one in this community has built and released a dedicated Zigbee Router firmware image specifically for that EFR32MG13P732F512 (EFR32MG13P with 512KB flash storage), and that is what you need to build and compile specifically for that specific device.

https://github.com/SiliconLabs/gecko_sdk

See Zigbee application examples:

https://github.com/SiliconLabs/zigbee_applications

For example check out their "Zigbee Human Detection" example which also function as a always-on Zigbee Router device with a join button:

https://github.com/SiliconLabs/zigbee_applications/tree/master/zigbee_human_detection

That is, the only existing community built dedicated Zigbee Router firmware release I know of are for EFR32MG21A020F768IM32 (which is a EFR32MG21 with 768 KB Flash Storage) so those will not work and not sure if you can gleam any information from those binaries without asking those that built them what exact configuration they are using in their builds (which are known to work very well)?

https://github.com/xsp1989/zigbeeFirmware/tree/master/firmware/Zigbee3.0_Dongle-NoSigned/RouterForDongle

https://github.com/itead/Sonoff_Zigbee_Dongle_Firmware/tree/master/Dongle-E/Router

[conforce]

this ts0207 crashed my network.. wondering why... it is visible in z2mqtt but no devices really connect with it.. any advice?