New hackable ESP gadgets in local budget store "action" !!!

[FanOfHue]

Yesterday i found some nice new products available in the Dutch Action store.
A full range of Wifi sensors and lights most of them under 9.95 euro each.

I bought some sensors to see what's inside and some of them have the Tuya ESP8266 module. So hack friendly i guessed

So my first "SmartNodeRules" PIR sensor prototype is now running!
It sends a messagebus event to all nodes on a PIR trigger and dumps some syslog messages as well.

Next victim will be the doorsensor.

The hand remote is not ESP8266 based, so that will not be an option.
(sadly)

[Dick60]

Nice, can you share a photo of the pir mentioned by you so I can buy one myself.

[Domosapiens]

https://www.action.com/nl-nl/brand/lsc-smart-connect/

[Dick60]

Nice, keep posting your results. A few times a month I visit this store but never noticed theses items. I will buy a module for testing.

[FanOfHue]

The doorsensor has also been migrated to a SmartNode with custom firmware.

[ManS-H]

The doorsensor has also been migrated to a SmartNode with custom firmware.

Can you told use how to flash the firmware? Open the device, soldering wires etc, with a few pictures should be nice.

[FanOfHue]

I seems that you can use a project named Tuya-Convert to replace the firmware OTA way, but then you would need an RPI-3. I don't have one, so i took the hardware hack road:

Doorsensor.png (456.95 KiB) Viewed 201577 times

Not really difficult to do. A siimple header gives access to RX/TX and GPIO-0 and that's all you need. I used Arduino IDE to upload the firmware in the same way as with other ESP8266 modules. Tuya modules are also very well documented. Just google for TYWE3S.

When initial upload is done, you can remove the header because future updates will be done with standard ESP8266 OTA.

[Maarten112]

The doorsensor has also been migrated to a SmartNode with custom firmware.

Did you measure the powerconsumption when running the doorsensor on tasmota/is the esp8266 put to sleep/deepsleep using interrupts? I'm very curious about batterylife of those sensors when running on tasmota!

[RayEbb]

Yesterday i found some nice new products available in the Dutch Action store.
A full range of Wifi sensors and lights most of them under 9.95 euro each.

I bought some sensors to see what's inside and some of them have the Tuya ESP8266 module. So hack friendly i guessed

So my first "SmartNodeRules" PIR sensor prototype is now running!
It sends a messagebus event to all nodes on a PIR trigger and dumps some syslog messages as well.

Next victim will be the doorsensor.

The hand remote is not ESP8266 based, so that will not be an option.
(sadly)

Thx. for this tip!! Today i only bought the RGB LED strip, just to try. It works great!!

[zizitop75]

Hi could you please explain how you flashed the led ruban contrôler. Thank you

[patricx]

i have flash the lsc doorsensor but how do i config it as a working sensor ?

[bulthaup]

How can you put the LSC door sensor in flash mode?

[Tecumseh]

I found some more info and a tear-down of these devices on a the German forum mikrocontroller.net. It seams that the OTA update with Tuya-convert has been disabled by Tuya with a new firmware and these devices would have the new update. Also some of these devices don't have the esp8266 or esp8285 chip onboard that would enable us to change the firmware to espeasy. Although some items do have a chip with almost the same pinout as the esp-12f so a switch could be made.

What I have not found yet is how we would configure these devices after flashing them with espeasy. What pins are connected where and how do we configure deepsleep to get a sustainable battery life.

[pgielen]

IA siimple header gives access to RX/TX and GPIO-0 and that's all you need.

And of course 3v3 and GND. Can you put the chip in flash mode by connecting GPIO-0 to GND?

[FanOfHue]

Chip/Module used:

Switch Plug ESP8285-TYWE2S
Door Sensor ESP8266-TYWE3S
PIR Sensor ESP8266-TYWE3S
Hand Remote RTL8710BN-WR3
Sirene RTL8710BN-WR3
Led Strip ESP8266-TYWE3L

At least the ESP editions can be flashed with ESP Easy or similar stuff. I'm not aware of any custom firmware for the RTL modules.

[FanOfHue]

I found some more info and a tear-down of these devices on a the German forum mikrocontroller.net. It seams that the OTA update with Tuya-convert has been disabled by Tuya with a new firmware and these devices would have the new update. Also some of these devices don't have the esp8266 or esp8285 chip onboard that would enable us to change the firmware to espeasy. Although some items do have a chip with almost the same pinout as the esp-12f so a switch could be made.

What I have not found yet is how we would configure these devices after flashing them with espeasy. What pins are connected where and how do we configure deepsleep to get a sustainable battery life.

Switch Plug is like this:
gpio 4 is LED (0 = on)
gpio 12 is relay (1 = on)
gpio 14 is switch (0 = pressed)

The battery operated devices do not need deepsleep config. The second MCU used on these devices controls the power to the ESP. Without trigger, the ESP is just powered off. When triggered, ESP will be powered on.

[bulthaup]

I found some more info and a tear-down of these devices on a the German forum mikrocontroller.net. It seams that the OTA update with Tuya-convert has been disabled by Tuya with a new firmware and these devices would have the new update. Also some of these devices don't have the esp8266 or esp8285 chip onboard that would enable us to change the firmware to espeasy. Although some items do have a chip with almost the same pinout as the esp-12f so a switch could be made.

What I have not found yet is how we would configure these devices after flashing them with espeasy. What pins are connected where and how do we configure deepsleep to get a sustainable battery life.

Switch Plug is like this:
gpio 4 is LED (0 = on)
gpio 12 is relay (1 = on)
gpio 14 is switch (0 = pressed)

The battery operated devices do not need deepsleep config. The second MCU used on these devices controls the power to the ESP. Without trigger, the ESP is just powered off. When triggered, ESP will be powered on.

Have you tried configuring the Door sensor already? Any idea about the GPIO settings?

[FanOfHue]

AFAIK, the door sensor has no GPIO attached to any hardware. Only RX/TX is connected to the other MCU.
I'm working on a serial plugin for ESPCoreRules to read the status from the other MCU and instruct it to power off again.

I have seen an existing plugin for ESP Easy to controll Tuya MCU that might be enhanced to support the Door Sensor.

[FanOfHue]

Latest commit of ESPCoreRules has a work-in-progress quick and dirty plugin for the doorsensor:
ESPCoreRules/_P201_TUYA.ino

You might be able to see how it works from this plugin:
https://github.com/SmartNodeRules/ESPCo ... 1_TUYA.ino

The plugin currently sends messages received from the second MCU to a syslog server. I could see from the syslog server that all is working.
The PIR sensor works in a similar way.

[enesbcs]

AFAIK, the door sensor has no GPIO attached to any hardware. Only RX/TX is connected to the other MCU.
I'm working on a serial plugin for ESPCoreRules to read the status from the other MCU and instruct it to power off again.

I have seen an existing plugin for ESP Easy to controll Tuya MCU that might be enhanced to support the Door Sensor.

Is it similar to these gocomma/Neo door sensor?

[RobinS]

Have you tried configuring the Door sensor already? Any idea about the GPIO settings?

Hello,
I also stumbled across the LSC stuff in the action store and decided to give it a try.
In the last couple of days, I have been reverse engineering the door sensor.

My conclusions sofar:
I have removed the WiFi module so I could draw up some course schematic, and the Wifi module only uses its serial connections (RXD0, TXD0).
The reed contact (door sensor) is directly connected to the MCU, which powers on the Wifi module when its activated.
The Wifi module needs to initiate the communication, after some data exchange the MCU will sent the contact state to the Wifi module and the cloud.
I also logged the communication and unfortunately it uses a dialect of the Tuya protocol (see https://images.tuyacn.com/smart/aircon ... a-MCU.pdf ).
The MCU on the door sensor board uses some slightly different command codes than the standard.
The devices functions commands, listed as 0x06 and 0x07 in the Tuya document seem to be merged and have replace command 0x05.
I also checked the Tasmota Tuya protocol support in the Tuya dimmer module, and this does seem to support the switch functionality, but unfortunately it can not support the LSC Door sensor, as it uses the wrong command to communicate it It however should allow enough communication to allow the MCU to send the contact status to tasmota.

The original firmware is however quite fast in sending data to the cloud, as the total WiFi module power on time is approx 5.6 seconds.
In this time frame the module connects to the Wifi network, and sends the data to the cloud. It then takes several seconds more before a open/close notification is received on the app / phone.

The door sensor uses approx 5.8 - 6 µA when its in idle (no communication).
When the MCU wakes up, the current increases to 580-600 µA (Wifi module was removed from the board)
With the Wifi module I noticed current of 88 mA+ on my PSU (did not accurately measure this yet).

I expect that running Tasmota on the door sensor will reduce battery life as I think that Tasmota will require much more time than the 5.6 seconds to send the data.
Note: as the mikrocontroller.net forum post is more technically orientated, I will post my detailed findings there. (unless its desired here as well).

Best Regards,

Robin

[FanOfHue]

I also reverse engineered the serial protocol to find out that it's not really following protocol as documented.

Taken from my plugin comments:

* tuyaSend <cmd>,<len>,<value> Send a serial message to the 'tuya' MCU as used on LSC Smart Connect PIR and Doorsensors
*
* Still debugging. Official documentation does not seem to match with commands used for PIR/Doorsensor
* tuyasend 1,0,0 Get device info from MCU
* tuyasend 2,1,0 fast blink LED
* tuyasend 2,1,1 start AP/config mode, power stays on, slow blink LED
* tuyasend 2,1,2 LED blink off
* tuyasend 2,1,3 ??
* tuyasend 2,1,4 Get device status from MCU

The main trick is to send command 2 with option 4. The MCU will send the status and will power off shortly after.
The whole procedure takes like 5 seconds on ESPCoreRules. ESP Easy could be similar but have not build a plugin for it.

[RobinS]

@FanOfHue,
Good to see you progress as well.
Here is a my more detailed view on it.
I found that they do reuse mayor parts of the Tuya protocol, but have shifted some commands.
It follows the query sequence, but uses different command ID's, however with the same contents as the originally intended command ID.
It starts with the Product ID query => same as Tuya protocol. However the product ID info is missing the mode part.
Then it only uses command 0x02 (Query the working mode of the Wi-Fi module), where I would expect also command 0x03 (Report the network connection status of the device.) as a reply to report the status of the wifi connection. However the contents of the 0x02 messages with payload does follow the contents of command 0x03.
When the Wifi module reports status 5 (status code 0x04) (The device connects to the router and cloud) then the MCU starts reporting its status (and contact).
This however is not done with commands 0x06 and 0x07 as in the normal Tuya protocol, but all with command id 0x05 which is originally assigned to (Reset the Wi-Fi module and select a network configuration mode.) But the contents of the message follows again that of the offical Tuya commands 0x06 and 0x07.
So as you experienced sending the 0x02 command with 0x04 status will trigger the status as the MCU recieves a connection up event.
I have attached my sniffing results in the 7z, as I could not attach an excel file directly.

I think that for the other LSC devices command 0x05 (with the Tuya structure of commands 0x06 and 0x07) can be used to access the devices functions (reporting and quering).
Sending the connection up the MCU will then trigger the status reporting.

The response times you mentioned of ESPCoreRules and ESP easy sound really good.
I will look into them in more detail, as I not familiar with them.

[Robvs]

Ho Robin,
Closely watching your progrees. It would be really need when the doorsensor works with tasmota.

So which status is the ESP set in by the MCU when being idle? Its not a complete power down since its serial communication need to be kept alive to wake up again right?

[RobinS]

Ho Robin,
Closely watching your progrees. It would be really need when the doorsensor works with tasmota.

So which status is the ESP set in by the MCU when being idle? Its not a complete power down since its serial communication need to be kept alive to wake up again right?

Hi Robvs,

Thanks, but after some investigations I have decided to skip both Tasmota and ESPEasy for now.
Although I have now been able to modify and build the Tasmota firmware, the Tuya dimmer implementation is too fit for its purpose and will require quite some re-work.
Besides this I could not find any documentation on the Tasmota inner workings, so this will take quite some time as well. I came to the same conclusion with ESPEasy.

As I want my LSC smart devices operation asap, on my MQTT infrastructure I have decided to first develop an driver in a new clean project.
This will allow me to quickly to get up to speed with my driver development and test it in practice, although less universal as I would like.
When I have this operational, I am planning to port this into Tasmota, hopefully with some guidance from an experienced Tasmota developer.

I will still post my progress here and am planning to open source this project when finished.

Regarding the ESP state:
The default ESP state is dead... (its always powered off by the MCU)
When the MCU is triggered (powerup, contact change, or button pressed in the battery compartment) [for the doorsensor], the MCU will power on the ESP.
The MCU will however not send its status to the ESP, until it gets the report from the ESP that it has a fully functional network connection.
I estimate that the MCU will power off immediately when it receives the sort of acknowledge from the ESP.
I also estimate that the MCU will keep the ESP powered during the time there is idle communication.
However in my tests without ESP I have noticed that the MCU will power cycle the ESP when it does not receive a valid frame every x seconds. (did not time it).
And noticed that it will do this for a max 16 ... 20 second period, which I estimate that this could be the maximum time the MCU will allow the ESP to communicate.

If so then it will be impossible to configure Tasmota within this time frame.
I now kept the ESP powered with an external power source to keep it running, regardless of the MCU state.

Best Regards,

Robin

[bulthaup]

Hi, please keep this thread alive. Hacking these Action things is always fun

[Ggaljoen]

Promotion prices from tomorrow for BE & NL, maybe in other countries too...

[tim]

Promotion prices from tomorrow for BE & NL, maybe in other countries too...

Thanks for the tip! Just went to the store and got me some smart plugs and a doorsensor.

I see more people discussing it here, what is the status for ESP Easy? Can i try the doorsensor with the latest ESP Easy build already?

[Legoracers]

Has anyone got the door sensor running on custom firmware? Earlier in this post, I read that the ESP is turned on when the door is open. Is it turned off immediately when it is closed? Because the magnet is not a GPIO pin it is harder to write my own code and was thinking about an MQTT message with a "last will" when it disconnects from the server.

[Legoracers]

I just hooked up my multimeter and it boots up every time the sensor changes state, a little different than I expected.

[Robvs]

So it boots when a door is opened (sound like normal behaviour, the secondary MCU wakes up de ESP and that sens a message)
And ik boots when a door is closed? (bit strange I think)

Is this also the case when closing happened right after opening?

[ManoBiletsky]

I have also bought 2 ceiling lamps, 2 motion sensors, 1 door sensor and a siren.

Allthough all the boxes say that they are compatible with Alexa, except for the ceiling lights, non of the devices work with alexa.

The door sensor is discovered by Alexa, but the state is not updated. All i want is alexa to tell me when the door is opened.

Have any of you got any idea how to do this? Is it possible with tasmota?

[FanOfHue]

Has anyone got the door sensor running on custom firmware?

I have one running with SmartNodeRules. Just updated the plugin so it creates a rule event "TUYA#Event=<state>" when the sensor detects a change.

Sample rule:

Code: Select all

On TUYA#Event do
  msgbus %sysname%/DoorSwitch=%eventvalue%
endon

Any of the other smart nodes can now act upon this event

[Maarten112]

Has anyone got the door sensor running on custom firmware?

I have one running with SmartNodeRules. Just updated the plugin so it creates a rule event "TUYA#Event=<state>" when the sensor detects a change.

Sample rule:

Code: Select all

On TUYA#Event do
  msgbus %sysname%/DoorSwitch=%eventvalue%
endon

Any of the other smart nodes can now act upon this event

Nice!

How long does the uC keeps the tywe3s (esp) on when the firmware don't actively sends the rights messages over uart to the uC?

[FanOfHue]

How long does the uC keeps the tywe3s (esp) on when the firmware don't actively sends the rights messages over uart to the uC?

It's about 13 seconds in total in my case. Takes 3 seconds to get connected. I can ping it for about 10 seconds.
With serial comms, it's only powered for 5 seconds, so it will save on battery life

[Legoracers]

How does SmartNodeRules know when the door is open or closed?

[Maarten112]

How long does the uC keeps the tywe3s (esp) on when the firmware don't actively sends the rights messages over uart to the uC?

It's about 13 seconds in total in my case. Takes 3 seconds to get connected. I can ping it for about 10 seconds.
With serial comms, it's only powered for 5 seconds, so it will save on battery life

Thank you! Enough time to trigger a startup rule on espeasy

I'm busy reverse engineering the serial communication between the Uc and the tuya esp, would be nice to have the real sensor state instead of working with a variable in an espeasy rule. Not sure if I have enough knowledge to fully reverse engineer it.

[Maarten112]

How does SmartNodeRules know when the door is open or closed?

it doesn't. I think FanOfHue use a variable to keep track of the state, e.g. -->

- initial state: variable = 0 --> closed
- if tuya esp wakes up & variable = 0, set variable to 1 --> open
- if tuya esp wakes up & variable = 1, set variable to 0 --> closed

nothing wrong to use a logic like that with a window, but when you use a door that is quickly opened and closed, it will give trouble.

Maybe FanOfHue can give some more info about how he implemented it

[FanOfHue]

How does SmartNodeRules know when the door is open or closed?

My SmartNodeRules plugin communicates with the onboard MCU to get the status. No variable needed at all.

Current rules:

Code: Select all

On System#Boot do
  tuyasend 1,0,0
  tuyasend 2,1,2
  tuyasend 2,1,3
endon

On Wifi#Connected do
  sendtoudp 255.255.255.255,65501,Door1 Boot %millis%
  tuyasend 2,1,4
Endon

on TUYA#Event do
   sendtoudp 255.255.255.255,65501,%sysname%/DoorSwitch=%eventvalue%
endon

When sending tuyasend 2,1,4, the MCU sends a status message that contains the door open/close state.

[Maarten112]

Very nice! So you already decoded the protocol I was just looking at it and saw how the esp get's the status from the uC

https://github.com/SmartNodeRules/ESPCo ... 1_TUYA.ino

Awesome work!

[jme]

Hi,

I just bought a door sensor and a pir sensor.

Could you give us some more detailled info how do you flash it, with wich firmware ?

Can we integrate it with Domoticz ?

Thx

[FanOfHue]

Hi,

I just bought a door sensor and a pir sensor.

Could you give us some more detailled info how do you flash it, with wich firmware ?

Can we integrate it with Domoticz ?

Thx

I used the hardware way, using a header (see picture in earlier post). Boot with GPIO0 low to get it into flash mode. This is all standard and must already be documented in great detail all over the internet.

I'm using it with Domoticz. But in my home all sensors are using the messagebus protocol, so the sensor does not directly communicate with Domoticz. It keeps the sensor firmware very lean and mean. I use WindowsRules to catch all messagebus events and that will update Domoticz and the Hue Bridge.

WindowsRules sample:

Code: Select all

on LSCDOOR2/DoorSwitch=0 do
  sendToHTTP %DomIP%,8080,/json.htm?type=command&param=switchlight&idx=393&switchcmd=Off
endon
on LSCDOOR2/DoorSwitch=1 do
  sendToHTTP %DomIP%,8080,/json.htm?type=command&param=switchlight&idx=393&switchcmd=On
endon

All HTTP and SSL stuff is done by my Windows machine because it's a lot faster than ESP firmware (mainly SSL issue) and my Windows system (Intel NUC) is powered 24x7 anyway so this gives me a system that is much more powerful than ESP or Raspberry. It also runs Powershell and C# and those are my favorite languages.

[whatsupskip]

Has anyone seen similar devices available from AliExpress or similar?

Based in Australia so buying from the store above isn't a good option. Our local Kmart has similar devices for A$25, compared to the ones listed above, which would be about A$17. Big difference.

[maxe2]

Hi community,

@FanOfHue: Could you please upload the firmware you used? I want to flash my door sensor and use the same smartnoderules as you did.

@whatsupskip: This one looks like the same door sensor as from action store

https://www.aliexpress.com/item/3304748 ... b201603_53

Regards,
Maxe2

[Maarten112]

@FanOfHue: Could you please upload the firmware you used? I want to flash my door sensor and use the same smartnoderules as you did.

Hi Maxe2,

You can see the code FanOfHue made on github and use it for your sensor!

https://github.com/SmartNodeRules/ESPCoreRules

[maxe2]

I tried to build my own firmware from here https://github.com/SmartNodeRules/ESPCoreRules with success but did not manage to get MQTT to work properly

[tim]

Can i ask who all are using the doorsensor and what firmware? I have one waiting to get flashed if the firmware can be downloaded.
I want to connect it to another ESP that runs ESP Easy.

Thanks to anybody who can help me to start using this device
And when working i want to buy some more!

[FanOfHue]

I want to connect it to another ESP that runs ESP Easy.

Using smartnoderules on the sensor and gateway should also work for ESP Easy, although i did not test it because i have no ESP Easy devices running anymore. You can give it a try, just connect the 'gateway' to an ESP Easy device (link both serial ports) and you should receive events like this on ESP Easy:

ESPNOW#1=LSCDoor1/DoorSwitch=0
ESPNOW#1=LSCDoor1/DoorSwitch=1
ESPNOW#2=LSCDoor2/DoorSwitch=0
ESPNOW#2=LSCDoor2/DoorSwitch=1

I bridge all ESPNOW events to the msgbus like this:

on ESPNOW* do
msgbus %eventvalue%
endon

But it's entirely up to you how to handle these events

[FanOfHue]

ESPNOW was a small but useful side step to improve the firmware for use on the LSC devices.
For all that have asked for more detailed timing specifics, i hooked up a logic analyzer to get some accurate timings.

Global graph, edge triggered on the reed contact, checking VCC power line and serial communications:

DoorSensorTiming1.png (45.28 KiB) Viewed 192226 times

As mentioned, the doorsensor needs or just takes 500 mSeconds before power-up the ESP module. This seems unavoidable.

From there we see three phases, zoom in to the active part:

DoorSensorTiming2.png (54.22 KiB) Viewed 192226 times

Bootloader part is fixed to 64 mSeconds.
Init part is currently 78 mSeconds, maybe there's something to gain if we look more into code detail
Communications is 144 mSeconds. In fact only the last one provides the real status, but it seems that we need all to make the "setup" button logic work.
This needs more testing, but for now i'm happy with the results.

The ESP is active for only 300 milliSeconds.

[peterbuijs]

LSC Smart Connect Power Plug
Flashing with ESPEasy Image for 8285 works (ESPEasy_mega-20190926)

http://192.168.100.52/control?cmd=GPIO,12,1 for Relay ON
http://192.168.100.52/control?cmd=GPIO,12,0 for Relay OFF
http://192.168.100.52/control?cmd=GPIO,4,0 for LED in Button ON
http://192.168.100.52/control?cmd=GPIO,4,1 for LED in Button OFF
GPIO 14 D5 Button Pressed is 0
GPIO 14 D5 Button Released is 1

Devices
Switch Device - Button GPIO 12
Switch Device - Relay GPIO 14

To Toggle ON/OFF with Button

Enable Rules

Rules Set 1

Code: Select all

on Button#State=1 do
  if [Relay#State]=1
    Gpio,12,0
    Gpio,4,1
  else
   Gpio,12,1
   Gpio,4,0
  endif
endon