Meawow MHO-C122 (2AWMOMHOC122) support
FaBjE opened this issue · 69 comments
Introduction
Recently I acquired a few of the Meawow MHO-C122 (2AWMOMHOC122) sensors for a bargain price.
Hoping I was able to scrape the sensor data from the advertisement or basic readout of some characteristics.
Long story short, with the default firmware: Data is not advertised, Readout is only on a proprietary protocol, you can only connect over Bluetooth when you just inserted the battery.
I tried if the OTA update page of this project had any luck but unfortunately not. The published characteristics are nowhere near what the default Xiaomi units publish.
4:11:00 PM: Searching for devices
4:11:02 PM: Connecting to: C121
4:11:13 PM: Not found Telink OTA service!
4:11:13 PM: Disconnected.
Opening up the unit I saw the PCB with almost identical setup/components as the Xiaomi units.
No wonder as these are produced by the same company (I believe)
Giving me the Idea if with maybe some minor tweaks the software of this project can be run on those units as well.
This issue will be my little blog/progress report. Feel free to help out if you have anything to add.
Meawow MHO-C122 (2AWMOMHOC122)
https://meawow.com/product/thermo-hygrometer/mho-c122/
Exteriour
The unit LCD/casing is identical to the MHO-C101
Interiour
I took the following pictures of the PCB
Front:
Back:
On that we can see the (familiar)
MCU: TLSR8251F512ET24
LCD: IST3055NA0
Sensor: (Probably) SHTV3
Software
The default software gives the following log when connecting with the nRF Connect app.
meawow connection log.txt
ToDo List
- Establish UART connection
- Retrieve original firmware
- Program with custom firmware + test
- Fix LCD layout
I have purged also 5 of these. Would be nice to flash firmware or to advertise ble so HA could pick these up.
I will follow this topic with interest.
I have also a couple of these and it would be nice if we can flash them to use with HA
same here! hope someone can figure this out..
I'm interested in this too, can't get them connected to HA
I've made some progress. I have made a little programmer jig with a CH340 I'm able to readout the flash contents of the MCU.
I should be able to program the unit with new firmware, But I haven't tried (yet).
You only need the three connection pads on the right of the PCB.
Original_Firmware_MHO_C122.zip
Using this schematic/instruction:
https://github.com/pvvx/TlsrComSwireWriter#telink-swire-simulation-on-a-com-port
- VCC is connected to the RTS to be able reset the MCU
- The PCB is clamped between a dual-row header (and some cardboard stuff) This provides exact spacing and does not require soldering to the PCB.
Things I have learned
- The silkscreen labels on the PCB can be deceiving. Reset is not the MCU reset, but just an IO pin.
- You cant use the programmer scripts from a Virtual machine, WSL or a docker container. The timing becomes too unstable.
- A full readout on the flash takes about 15 minutes. (for 512KB) But hey, I'm glad it works without buying an expensive programmer.
- This command worked best for me:
\python.exe TLSR825xComFlasher.py -p COM23 -t 70 rf 0 0x80000 firmware_download.bin
Good job!
Some progress was made. I managed to flash the ATC_v42.bin. and the good news is that bluetooth works.
The sensor and battery readout seems to work fine.
But the LCD is messed up. It seems to work, but the segment layout is different, so you get really weird data displayed.
I tried some other firmwares and these are the results:
- ATC_v42.bin: LCD Seems to work messed up segments, BT Temp/Humidity OK
- MHO_C401_v42: No LCD, BT Temp/Humidity OK
- MHO_C401N_v42.bin: No LCD, BT Temp/Humidity OK
Things I Learned
- My programming jig is really temperamental. So don't recommend copying it. I suspect the power from the RTS pin is not sufficient.
@pvvx Is there a way to easily identify the LCD segment layout? Like flash each segment one by one?
Control function ID when connected
| ID | Command |
|---|---|
| 0x60 | Get/Set LCD buffer |
6001020304...
60 - command
01020304... - lcd buffer
Creates a bit-map similar to the one shown here - epd_mho_c401n.c
Cut OTA file (CRC ok) -> https://github.com/pvvx/ATC_MiThermometer/blob/master/Original_OTA_MHO_C122_tuya.bin
This OTA file has a size of more than 128 kilobytes.
Typical Telink BLE firmware does not support OTA sizes larger than 128 kilobytes.
For this firmware, you will have to change the source code, approximately as done for MJWSD05MMC.
The latest versions of Tuya BLE transmission of advertising packages with sensor data.
Also in Tuya BLE there is a download OTA with a key signature. Some of the codes can be found on the Tuya Cloud.
"LocalTuya integration" in the "HA" misleads users by not indicating that BLE is not supported.
I've made an LCD segment map. I'll try to cook up a lcd driver for it.
Apologies for the mix between 0 indexed (bytes) and 1 indexed (bits), I guess I wasn't fully awake yet....
ATC_v42.bin: LCD Seems to work messed up segments, BT Temp/Humidity OK
What is the address of the LCD controller?
And how are things with Tuya OTA?
I recorded the firmware MHO-C122 in Xiaomi LYWSD03MMC (HW: B1.4).
Registered in "Smart Life":
Average Power:
nRFConnect (advertising):
Data is transmitted from the sensor.
https://iot.tuya.com/ (Registration in the cloud is free for all your devices registered in "Smart Life". All encryption keys are available.)
Device Management -> Get device details:
{
"result": {
"active_time": 1685239585,
"biz_type": 18,
"category": "wsdcg",
"create_time": 1685239585,
"icon": "smart/icon/bay1607936793441YbTx/03baef663c3c1a2149c7fbf98110e134.png",
"id": "bf7xxxxxxxxhrn",
"ip": "",
"lat": "xx.9400",
"local_key": "d+xxxxxxxxxxxxxx9-^",
"lon": "xx.1000",
"model": "MHO-C121",
"name": "Temperature Humidity Sensor",
"online": false,
"owner_id": "47xxxx61",
"product_id": "3nxxxxw6",
"product_name": "Temperature Humidity Sensor",
"status": [
{
"code": "va_temperature",
"value": 223
},
{
"code": "va_humidity",
"value": 39
},
{
"code": "battery_percentage",
"value": 100
},
{
"code": "temp_sampling",
"value": 6
},
{
"code": "temp_unit_convert",
"value": "c"
}
],
"sub": false,
"time_zone": "+03:00",
"uid": "eu164xxxxxxxxxxxx5HE",
"update_time": 1685239587,
"uuid": "15xxxxxxxxxxx9c9"
},
"success": true,
"t": 1685xxxxx7614,
"tid": "78xxxxxxxxxxxxxxxxxxxxxxxxxxxx2a"
}
- The data-keys has been changed (replaced with "xxxxx").
OTA is present. I haven't figured out how to program and where the keys are in the cloud yet...
There is a Telink SDK - ble_sdk_multimode_tuya. The old version. The SDK has OTA sources (ble_sdk_multimode_tuya\tuya_components\tlsr\tuya_ota.c).
Apologies for the mix between 0 indexed (bytes) and 1 indexed (bits), I guess I wasn't fully awake yet....
/*
* MHO-C122 LCD buffer: byte.bit
--0.4-- --1.4-- --2.4--
| | | | | | |
| 0.0 0.5 1.0 1.5 2.0 2.5
| | | | | | | o 3.0
0.3 --0.1-- --1.1-- --2.1-- +--- 3.0
| | | | | | | 3.0|
| 0.2 0.6 1.2 1.6 2.2 2.6 ---- 3.1
| | | | | | | 3.0|
--0.7-- --1.7-- * --2.7-- ---- 3.2
2.3
--5.3-- --4.3-- 1.3 1.3
(|) | | | | / \ / \
3.7 5.6 5.2 4.6 4.2 1.3( ___ 3.6 ___ )1.3
| | | | 1.3 / \ 1.3
BLE --5.5-- --4.5-- ___
4.7 | | | | 3.5
5.4 5.1 4.4 4.1
BAT | | | | %
5.7 --5.0-- --4.0-- 3.4
None: 3.3 ?
*/
Added a test version of MHO-C122.
So far, flash programming is only via hardware - SWS.
TelinkMiFlasher.html does not work with the original MHO-C122. With firmware MHO_C122_v43.bin something will work...
Check if everything is correct with the display.
What is the address of the LCD controller?
12:30:06 PM: Settings 02 was send successful
12:30:07 PM: Sensor: I2C addres 0x70, LCD driver: I2C addres 0x3C
And how are things with Tuya OTA?
Could not tell you. I tried an OTA in the app, but there was "no update available".
Whoops. I guess i was really still sleeping...
I checked and yes your correction is right.
Check if everything is correct with the display.
Thanks so much! I just can't find the time...
I will test this right now and report back.
To complete work with MHO-C122(C121), an OTA is required.
This is not the first thermometer with TUYA BLE PROTOCOL VERSION 4.
I haven't seen any solutions for the Tuya BLE (new version) OTA.
Also, there is no integration local BLE Tuya in "HA".
The description of the OTA protocol is in the cloud.
But you need to register.
https://developer.tuya.com/en/docs/iot-device-dev/OTA_BLE
It seems to give out all the keys.
It remains to understand the encryption method.
https://developer.tuya.com/en/docs/iot-device-dev/OTA_BLE?id=Kawer1ehuv8si seems freely available to me.
The example document at the bottom: https://images.tuyacn.com/smart/docs/OTA-update-sample.docx seems to list an example how to implement the tuya way in the MCU.
Maybe this helps you to implement it in the TelinkFlasher page?
Full sample of Telink SDK Tuya.
https://github.com/pvvx/pvvx.github.io/blob/master/MHO_C122/bin/ble_sdk_multimode_tuya.zip
But this is an old version of Tuya. Was available on Telink official website earlier.
It is assembled in Telink IDE, works, registers in applications on a smartphone...
Maybe this helps you to implement it in the TelinkFlasher page?
There is still a lot to figure out.
- Add to the firmware the initial correction of the OTA download to another area.
- Restoring Tuya firmware.
- Request keys from the user or from the cloud
But the main thing is how to establish a connection with the cipher.
I didn't find anyone doing this. Disassembled the old version and with Wi-Fi. I haven't seen anyone who could handle the new version of Tuya.
PS: And for the whole summer I usually take a break from working at computers...
I found the source package tuya_ble_sdk_Demo_Project_tlsr8253 in the archive.
In the SDK, libs Tuya on most ARM:
libtuya_ble_sdk_lib_tlsr825x.a
tuya_ble_sdk_lib_arm_m0.lib
tuya_ble_sdk_lib_arm_m3.lib
tuya_ble_sdk_lib_arm_m4.lib
tuya_ble_sdk_lib_arm_m4f.lib
tuya_ble_sdk_lib_arm9e-s_little_endian.lib
Maybe this helps you to implement it in the TelinkFlasher page?
There is still a lot to figure out.
1. Add to the firmware the initial correction of the OTA download to another area. 2. Restoring Tuya firmware. 3. Request keys from the user or from the cloud But the main thing is how to establish a connection with the cipher.I didn't find anyone doing this. Disassembled the old version and with Wi-Fi. I haven't seen anyone who could handle the new version of Tuya.
I think the most beneficial one is to "update" from stock tuya firmware to "atc firmware"
Going back to Tuya firmware would be a "nice to have" imho. But I don't think it will be a much used feature.
PS: And for the whole summer I usually take a break from working at computers...
You should definitely do that too :)
I've been running this firmware: https://github.com/pvvx/ATC_MiThermometer/raw/20a087dcc2c234f48790ee618d7273444288a2b9/MHO_C122_v43.bin on three units now for two weeks.
Without any problems. So I'm declaring this "finished/stable"
For the initial firmware update a programmer is needed.
After the initial 'convert' the updates can be done over BLE using the telink flasher page.
Hey, i do not have a programmer and also no skills to make the programmer. Is it possible to send my 5 units so someone can program the firmware for me?
Awesome work! Is there any way in which the firmware can be flashed for mortals like me without having additional hardware to do so?
At the moment, it is possible to flash using a USB-COM adapter.
Connect only TX-SWS and GND wires:
https://github.com/pvvx/ATC_MiThermometer#the-usb-com-adapter-writes-the-firmware-in-explorer-web-version
It's boring to disassemble the BLE-Tuya firmware protocol alone... Analysis of BLE-Tuya is possible only in autumn... In the summer, I limit my work at the computer.
Hi Guys, have been following this post and reading a lot. I am actually quite stuck now...I took the following steps:
- solder 2 wires to the GND and SWS
- connect to USB serial flasher;
- opened the USB com flasher html
- tried two different files: MHO_C122_v43.bin and ATC_v43.bin
Now two C122 don't seem to start when I assemble them again. The screen stays blank.
I tried 2 different usb serial flashers. What am I doing wrong? Should it first be put in flash mode or what am I missing?
Much appreciated all your hard work and thanks in advance for your help!
Hi Guys, have been following this post and reading a lot. I am actually quite stuck now...I took the following steps:
1. solder 2 wires to the GND and SWS 2. connect to USB serial flasher; 3. opened the USB com flasher html 4. tried two different files: MHO_C122_v43.bin and ATC_v43.bin Now two C122 don't seem to start when I assemble them again. The screen stays blank. I tried 2 different usb serial flashers. What am I doing wrong? Should it first be put in flash mode or what am I missing? Much appreciated all your hard work and thanks in advance for your help!
If you insert the battery, can you see the device over bluetooth?
You can use https://play.google.com/store/apps/details?id=no.nordicsemi.android.mcp&hl=en&gl=US to check.
If so, the zebra strip of the LCD might be mis-aligned.
If not, there might be an other issue, I have not used the flasher html page myself.
But if the device behavior changes there is at least something happening.
Hi Guys, have been following this post and reading a lot. I am actually quite stuck now...I took the following steps:
1. solder 2 wires to the GND and SWS 2. connect to USB serial flasher; 3. opened the USB com flasher html 4. tried two different files: MHO_C122_v43.bin and ATC_v43.bin Now two C122 don't seem to start when I assemble them again. The screen stays blank. I tried 2 different usb serial flashers. What am I doing wrong? Should it first be put in flash mode or what am I missing? Much appreciated all your hard work and thanks in advance for your help!If you insert the battery, can you see the device over bluetooth? You can use https://play.google.com/store/apps/details?id=no.nordicsemi.android.mcp&hl=en&gl=US to check.
If so, the zebra strip of the LCD might be mis-aligned.
If not, there might be an other issue, I have not used the flasher html page myself. But if the device behavior changes there is at least something happening.
Seems to be completely dead, I see nothing happening, also no Bluetooth signal. I have a third one, so there is another chance, but then I have to be sure I am doing the right thing...any comments on the steps I took? It feels somehow I miss anything
Seems to be completely dead, I see nothing happening, also no Bluetooth signal. I have a third one, so there is another chance, but then I have to be sure I am doing the right thing...any comments on the steps I took? It feels somehow I miss anything
I would not sacrifice your third one yet. Flashing should not be "destructive." If you flash wrong software, you should be able to reflash good one.
Your steps seem OK to me, can you show a picture of your setup?
How did you connect to GND and SWS to your USB serial?
I think that follows the instruction properly right?
Upper wire is GND, Lower wire is SWS.
What serial converter do you use? What voltage levels is it (set to)?
You should use 3V3 logic level voltages (maximum)
And you should place the battery when programming, as you are not powering the unit by wire.
Got these pins DTR, RXD, TX, VCC, CTS, GND.
On wich pin do i need to connect sws ?
Serial Converter TX -> SWS
Serial Converter GND -> GND
Make sure to use 3V3 logic levels!
FTDI based converters are reported not to work
I build mine using a CH340E based converter (should be available on aliexpress as well)
@FaBjE you didn't use the html page to flash, but how did you flash the thermometer? I saw in one of your first posts
that you used python script ?
Upper wire is GND, Lower wire is SWS. What serial converter do you use? What voltage levels is it (set to)? You should use 3V3 logic level voltages (maximum) And you should place the battery when programming, as you are not powering the unit by wire.
Sure I use the 3.3, but I think the middle is the sws or am I missing something?
Upper wire is GND, Lower wire is SWS. What serial converter do you use? What voltage levels is it (set to)? You should use 3V3 logic level voltages (maximum) And you should place the battery when programming, as you are not powering the unit by wire.
What I didn't do is use the battery to power it. Is this necessary?
FTDI based converters are reported not to work
If RX. if FTDI is used, it checks the bit frame, but it does not match the 1-wire Telink
Chinese chips do not check each bit for several samples and the total timing of the RS symbol.
When an error is detected, RX FTDI does not output the violated character to the buffer, but sets an error flag.
What I didn't do is use the battery to power it. Is this necessary?
Power connection is desirable. Not all USB-RS circuits can produce enough current for the chip to receive power from the SWS output via input protection diodes :) And it is not provided, but sometimes it works.
@FaBjE you didn't use the html page to flash, but how did you flash the thermometer? I saw in one of your first posts that you used python script ?
I use the https://github.com/pvvx/TlsrComSwireWriter from the repository. But I think you also need to connect the RX for that.
Using a resistor https://github.com/pvvx/TlsrComSwireWriter#telink-swire-simulation-on-a-com-port
but I think the middle is the sws or am I missing something?
Yes middle connection pad, but his lower wire.
What I didn't do is use the battery to power it. Is this necessary?
Yes, see pvvx his explanation.
If RX. if FTDI is used, it checks the bit frame, but it does not match the 1-wire Telink
Thanks for explaining
Thanks mate, will try with a battery and let you know the results
USBCOMFlashTx is the easiest option when there is nothing more....
- USBCOMFlashTx.html has no feedback. Perhaps the firmware will be executed unsuccessfully. In this case, repetition is required.
- And the second problem is that the chip may be in sleep mode. For reliable programming, it is necessary to turn on the power during activation (ATime) or use a reset signal from the chip.
- After such programming, it is necessary to make a new OTA, since there is no guarantee of correct firmware using 'USBCOMFlashTx'.
Tried on breadboard yesterday with ch340 of wittyboard gnd sws and rst connected, but cant seem to flash new firmware.. do i need to set it in flash mode somehow? Every try i did it still had original firmware afterwards
What I did:
- tried with a battery and only connect SWS and GND: nothing happens
- see the picture: I also tried to connect the VCC on the 3.3: no result
- I don't use FTDI but a wchusbserial1420
Still nothing seems to happen - please let me know if there are any further ideas. Thanks a lot for your support!
@FaBjE you didn't use the html page to flash, but how did you flash the thermometer? I saw in one of your first posts that you used python script ?
I use the https://github.com/pvvx/TlsrComSwireWriter from the repository. But I think you also need to connect the RX for that. Using a resistor https://github.com/pvvx/TlsrComSwireWriter#telink-swire-simulation-on-a-com-port
but I think the middle is the sws or am I missing something?
Yes middle connection pad, but his lower wire.
What I didn't do is use the battery to power it. Is this necessary?
Yes, see pvvx his explanation.
If RX. if FTDI is used, it checks the bit frame, but it does not match the 1-wire Telink
Thanks for explaining
I was struggling a bit to get this to work since I think python on my Mac is giving some troubles. Also, I see a different way of connecting the devices, I havn't been using resistors and not sure how to do this. Let me know if this is absolutely a necessity and I will check this direction...
do i need to set it in flash mode somehow
Yes, programming mode is achieved by sending a "magic sequence" on the SWS line.
This must be done directly after power-up. Therefore I / the script uses the "RTS" line to switch power on the right moment.
You can either switch the power yourself and tune with the "activation time" or let the script do it for you using the RTS line.
My USB > UART converter was able to supply enough current over this line to power the programming circuit, but there is no guarantee.
I only used the script from the repository:
\python.exe TLSR825xComFlasher.py -p COM24 -t 50 wf 0 .\ATC_Thermometer.bin
Let me know if this is absolutely a necessity and I will check this direction...
Well it is not an absolute necessity, but the "TX only" method, is a bit risky.
The resistor is used to make from a 1 signal wire "uart" (The SWS protocol), a two-wire signal for a normal USB->UART converter.
When only the TX is connected the webpage/script just sends the data hoping the microcontroller accepts it. (Having no clue if it does or not)
With the resistor (and the RX line connected) the Python script from this repository is able to receive the reply from the micro-controller and check if it has accepted the data or not.
To all of you, I had a lot of struggles getting this to work either. It is simulating a (expensive) programmer on cheap hardware. So it is all a bit "tongue at the right angle" and hoping it works stuff.
Sometimes I just have reconnect the USB device and re-run the script and it does work for some magic reason.
Thanks mate, seems a bit more complex than I initially thought. I will give it another shot next weekend, but for now I'll leave it. I also hope the OTA will appear in a few months, seems to be my best bet ;-)
Hi all,
Just for my understanding. Can I already use the BLE updater for the C122 ?
Thanks all for you efforts on this project.
I will start considering the OTA option (firmware update via Bluetooth) only after the end of summer, when we run out of warm weather.
And it is desirable that by that time someone has support for receiving advertising the "Tuya" format. Otherwise, support for BLE advertising in the "Tuya" format will never appear in anyone's open-source.
I will start considering the OTA option (firmware update via Bluetooth) only after the end of summer, when we run out of warm weather. And it is desirable that by that time someone has support for receiving advertising the "Tuya" format. Otherwise, support for BLE advertising in the "Tuya" format will never appear in anyone's open-source.
Hi! It's been pretty chilly lately, any chance of a Ota update for these? :)
You forgot about the second point of the conditions.
Nobody wants to deal with Tuya.
Closed rospogrigio/localtuya#1166 as completed.
custom-components/ble_monitor#1063
...
Nice work so far. I got two of c122 flashed. They work and can connect with smart life from tuya! After a minute or two they go offline and don't report their status anymore untill i remove the battery and readd them in the app.
Just wondering if we can expect zigbee because that is something thats not dependend on the smart life app and online access. Next to that it would be easy to integrate into home assistant.
Was looking at https://github.com/pvvx/ZigbeeTLc but don't seem to get it to work
Anyway thanks so far!
Was looking at https://github.com/pvvx/ZigbeeTLc but don't seem to get it to work
What didn't work?
I don’t have an MHO-С122 and have nothing to test it on.
And there is an even more exotic option - https://github.com/pvvx/BZdevice
https://github.com/pvvx/BZdevice/raw/master/bin/1141-020b-01113001-ZMHOC122.zigbee
But there are still problems with BLE OTA...
@pvvx I was able to flash with https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html and the tuya binary. I couldnt flash the zigbee binary using the same url. How should I flash with the zigbee version ?
This is for TH05?
This is for TH05?
MHO-С122
TH05 - > SoC: PHY6222QC-W04I - Doesn't have an SDK for GCC. Only commercial version of the compiler.
@pvvx это не оно? https://github.com/SoCXin/PHY6222
No. This is the SDK from the PHY website shown earlier in the link.
But http://wiki.phyplusinc.com/ is not available.
https://github.com/SoCXin/PHY6222 использует Keil_v5\UV4\UV4.exe
https://developer.arm.com/documentation/101454/0103/License-Agreements-and-Terminologies/License-Agreement-MDK-v5-39-and-above
@almirus - несколько файлов с ранее доступного Wiki PHY (http://wiki.phyplusinc.com/).
https://disk.yandex.ru/d/wzDUNjGDgQQ3SQ
https://disk.yandex.ru/d/tfbbYqZwpJhfug
https://disk.yandex.ru/d/c3zjjsS0tdVNUA
https://disk.yandex.ru/d/5nQfaZK04RxHtQ
https://disk.yandex.ru/d/N-KskbuC2rpP6A
https://disk.yandex.ru/d/MY40cLa-E1i_kw
https://disk.yandex.ru/d/O-CYbrIgCbxeSg
https://disk.yandex.ru/d/G4xVukhfsQyxCg
https://disk.yandex.ru/d/z1gPgQqKDDnWmg
Покупайте Keil и программируйте.
@pvvx @FaBjE I was able to flash with https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html and the tuya binary. I couldnt flash the zigbee binary using the same url. How should I flash with the zigbee version ?
Hi @pvvx I am a bit lost of the flasher pages give me a
00:03:06: Searching for devices
00:03:10: Connecting to: C121
00:03:11: Not found Telink OTA service!
What am I doing wrong (am I doing something wrong?)
I did manage to usb flash it using https://pvvx.github.io/ATC_MiThermometer/USBCOMFlashTx.html but there is no Zigbee binary to flash from this website.
@pvvx same issue. Give a
Not found Telink OTA service!
TelinkMiFlasher does not work with the original Meawow MHO-C122 firmware. Firmware is carried out using wires...
Further OTA will work in TelinkMiFlasher.