logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Converting WRG1 and TYZS3 Zigbee Gateways to OpenBeken

insmod 1569 12
ADVERTISEMENT
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • Converting WRG1 and TYZS3 Zigbee Gateways to OpenBeken
    This guide will show you how to convert WRG1 and TYZS3 Zigbee gateways to OpenBeken.

    There are several known variants using this combination.
    1. ZXGWZ-04 (internal board is named TYGWZW1), seen here
    2. JMWZG1 (JMZ1-V1.2 or JMZ1-V1.3), seen here
    3. TYZG1 (JZZWD-TY1.1), seen here

    If you have a WBRG1 module instead of WRG1, see here

    Pictures
    Converting WRG1 and TYZS3 Zigbee Gateways to OpenBeken Converting WRG1 and TYZS3 Zigbee Gateways to OpenBeken

    Be warned, that they can't be flashed via UART, you would need to buy a J-Link adapter
    Chinese J-Link OB clone for $2 would work too
    Converting WRG1 and TYZS3 Zigbee Gateways to OpenBeken

    If you previously haven't used J-Link, you will need to install drivers.
    From attached rtl8711am.rar install JLink_Windows_V632g.exe

    When you've installed drivers and connected J-Link, check if you have "J-Link driver" in device manager under USB controllers, and not an unknown device.

    Connect your J-Link to SWD port of WRG1 module (SWCLK_WIFI and SWD_WIFI)
    First, you need to take a backup.
    Execute RTL8711AM_ReadFlash.bat
    It would create rtl8711am_dump.bin. That is your 4MB backup of RTL8711AM internal flash.

    Open RTL00Flasher (ignore Flash ID warning if it shows)
    Converting WRG1 and TYZS3 Zigbee Gateways to OpenBeken
    Download latest OpenRTL8710A JTAG firmware from https://github.com/openshwprojects/OpenBK7231T_App/releases
    Latest at the moment of writing this post: https://github.com/openshwprojects/OpenBK7231...s/download/1.18.135/OpenRTL8710A_1.18.135.bin
    Open page "Auto", where button "Write Flash" is located. Check "Image1" and "Image2,3". Ensure that checkboxes "System data" and "Calibration data" are not set. That way we will preserve original MAC address and WiFi calibration.
    Then press "Write Flash" and select previously downloaded firmware. Flashing will begin automatically.

    Once flashed, connect UART to LOG-TX/L-TX and LOG-RX/L-RX, set baud rate to 38400.
    Power-cycle the device.
    If everything gone right, you will see OpenBeken boot log.
    Code: text Expand Select all Copy to clipboard
    <RTL8195A>=========================================================

ROM Version: 0.3

Build ToolChain Version: gcc version 4.8.3 (Realtek ASDK-4.8.3p1 Build 2003) 

=========================================================
Check boot type form eFuse
SPI Initial
Image1 length: 0x53a8, Image Addr: 0x10000bc8
Image1 Validate OK, Going jump to Image1

BOOT from Flash:YES

===== Enter Image 1 ====
SDR Controller Init

OTA Im INVALID

load NEW fw 0
Flash Im2:Addr 0xb000, Len 223448, Load to SRAM 0x10006000
Im3 length: 0x7ca00, Im3 Addr: 0x30000000
Im2 Sign: RTKWin, InfaStart @ 0x10006189 
===== Enter Image 2 ====
interface 0 is initialized
interface 1 is initialized

Initializing WIFI ...
WIFI initialized

init_thread(53), Available heap 0x23a78OpenRTL8710A, version dev_20250714_133008
Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
...
...

    Connect to newly-created access point and via http://192.168.4.1 configure to your needs.
    OBK pin setup:
    PB2 - Button
    PC0 - Blue led
    PC1 - Red led


    Time to flash TYZS3.

    Connect your J-Link to SWD port of TYZS3 module (SWCLK and SWD on the right side of the module)
    First, of course, is taking a backup.
    Execute TYZS3_ReadFlash.bat
    It would create tyzs3_dump.hex
    Open Simplicity Commander and select your J-Link adapter
    J-Link adapter connected to a WRG1 module PCB via wires to SWD pins.
    Open Flash category, click "Browse..." and select any of included in rtl8711am.rar .gbl files
    1. tyzs3_zigbee_ncp_7.4.5.0_115200_swflow_buf64.gbl - previously tested by me for several months. Working.
    2. tyzs3_zigbee_ncp_7.5.0.0_115200_swflow_buf64.gbl - only confirmed that it works and connects to Zigbee2MQTT, nothing else.
    3. tyzs3_zigbee_ncp_7.5.0.0_115200_swflow_nobuf.gbl - not tested. Main difference is default RX buffer. In 7.4.x there was some bug, so an increased buffer was required. Unknown if it was fixed in 7.5.0
    4. tyzs3_zigbee_ncp_7.5.0.0_115200_rtscts_buf64.gbl - confirmed that it works and connects to Zigbee2MQTT, but no true testing was done. Comes with hardware flow offloading. Should be the best variant.
    5. tyzs3_openthread_rcp_2.4.6.0_230400_swflow_buf64.gbl - OpenThread firmware with software flow control. Not tested.
    6. tyzs3_openthread_rcp_2.4.6.0_230400_rtscts_buf64.gbl - OpenThread firmware with hardware flow control. Not tested.

    When you've selected firmware that you chose, click "Flash" and wait until it is done.
    Disconnect J-Link adapter and power it via USB.

    Autoexec/startup command for OpenBeken:
    Code: text Expand Select all Copy to clipboard
    startdriver uarttcp 115200 512 1 1
SetChannelLabel 1 "Bridge Connection"
SetChannelVisible 1 0
SetChannelType 1 OpenClosed_Inv

    Now, depending on what firmware you flashed to TYZS3, edit first line and replace in first line last symbol with 0 if you flashed swflow firmware. Keep 1 if you flashed rtscts firmware.

    When adding this gateway as an adapter to either ZHA or Zigbee2MQTT, use this string:
    Code: text Expand Select all Copy to clipboard
    tcp://<OBK_IP>:8888

    Replace <OBK_IP> with whatever IP was set up to your device by DHCP or static IP if you configured it.
    Attachments:

    Cool? Ranking DIY
    About Author
    insmod
    Level 26  
    Offline 
    insmod wrote 736 posts with rating 239, helped 98 times. Been with us since 2024 year.
  • ADVERTISEMENT
  • #2 21607779
    divadiow
    Level 35  
    are these the same across the 3 gateway variations and what is the template assignment in json? I don't have RTL-AM to quickly see what pins they are

    insmod wrote:
    OBK pin setup:
    PB2 - Button
    PC0 - Blue led
    PC1 - Red led
  • #3 21607790
    insmod
    Level 26  
    >>21607779
    Probably yes, since they're all based on the same template.
    Likely the same with WBRG1 gateways.
  • ADVERTISEMENT
  • #5 21607820
    insmod
    Level 26  
    I use blue led for wifi, and red for zigbee
    So 9 is WifiLED. 10 remains as it is, and 7 should use different channel.
  • #6 21608001
    p.kaczmarek2
    Moderator Smart Home  
    Very interesting, I didn't look into Zigbee gateways yet. Still, I have a question - how exactly this traffic going through gateway look like? That going through uarttcp? Is it JSON?

    I am curious how reasonable would it be to let OBK control Zigbee directly, not just act like TCP to UART gateway.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #8 21636423
    svetlinp
    Level 8  
    How to restore original firmware from 4 MB rtl8711am_dump.bin ?
  • #9 21636458
    insmod
    Level 26  
    >>21636423
    First try to do it via RTL00Flasher, select everything and then write flash.
  • ADVERTISEMENT
  • #10 21636781
    svetlinp
    Level 8  
    After restoring device, it's not booting correctly. I restored TYZS3_dump.hex to TYZS3. This is the log file for RTL8710 booting. I cannot understand where the problem is: is it the RTL or the Zigbee module?
    Code: text Expand Select all Copy to clipboard
    =========================================================

ROM Version: 0.3

Build ToolChain Version: gcc version 4.8.3 (Realtek ASDK-4.8.3p1 Build 2003)

=========================================================
Check boot type form eFuse
SPI Initial
Image1 length: 0x53a8, Image Addr: 0x10000bc8
Image1 Validate OK, Going jump to Image1

BOOT from Flash:YES

===== Enter Image 1 ====
SDR Controller Init

OTA Im INVALID

load OLD fw 0
Flash Im2:Addr 0xb000, Len 270024, Load to SRAM 0x10006000
Im3 length: 0x89200, Im3 Addr: 0x30000000
Im2 Sign: RTKWin, InfaStart @ 0x10006189
===== Enter Image 2 ====
interface 0 is initialized
interface 1 is initialized

Initializing WIFI ...
WIFI initialized

[01-01 18:12:15 TUYA Info][mqc_app.c:337] mqc app init ...
[01-01 18:12:15 TUYA Info][uni_thread.c:205] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:4096,priority:5
[01-01 18:12:15 TUYA Info][uni_thread.c:205] thread_create name:cmmod,stackDepth:4096,totalstackDepth:8192,priority:4
[01-01 18:12:15 TUYA Debug][mqc_app.c:148] mq_pro:5 cnt:1
[01-01 18:12:15 TUYA Debug][mqc_app.c:148] mq_pro:31 cnt:2
[01-01 18:12:15 TUYA Err][log_seq.c:850] logseq empty
[01-01 18:12:15 TUYA Debug][svc_online_log.c:293] svc online log init success
[01-01 18:12:15 TUYA Info][uni_thread.c:205] thread_create name:wk_th-0,stackDepth:5120,totalstackDepth:13312,priority:3
[01-01 18:12:15 TUYA Err][tuya_ws_db.c:324] kvs_read fails gw_bi -1
[01-01 18:12:15 TUYA Debug][ws_db_gw.c:141] gw base read finish:-18
[01-01 18:12:15 TUYA Debug][tuya_bt_sdk.c:84] ty bt cmmod regist ok:1
[01-01 18:12:15 TUYA Debug][tuya_ble_api.c:105] upd adv para, send conn_req beacon.
[01-01 18:12:15 TUYA Notice][tuya_ble_api.c:397] ble sdk re_inited
[01-01 18:12:15 TUYA Notice][tuya_bt_sdk.c:125] ty bt sdk init finish
[01-01 18:12:15 TUYA Debug][group_scene_serve.c:2442] start group scene serve
[01-01 18:12:15 TUYA Debug][group_scene_serve.c:744] =====__group_scene_save_init=====
[01-01 18:12:15 TUYA Debug][group_scene_serve.c:781] group scene flag file: grp_sce_flag_file.
[01-01 18:12:15 TUYA Debug][group_scene_serve.c:782] group scene file: grp_sce_save_file.
[01-01 18:12:15 TUYA Debug][group_scene_serve.c:783] group scene back file: grp_sce_save_bak_file.
[01-01 18:12:15 TUYA Err][group_scene_serve.c:719] read grp_sce_list err. -1
[01-01 18:12:15 TUYA Debug][group_scene_serve.c:811] No old group scene flag file.
[01-01 18:12:15 TUYA Info][uni_thread.c:205] thread_create name:grp_sce,stackDepth:2048,totalstackDepth:15360,priority:3
[01-01 18:12:15 TUYA Debug][group_scene_serve.c:2474] end group scene serve
[01-01 18:12:15 TUYA Debug][tuya_device.c:781] < TUYA IOT SDK V:1.0.2 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.3_CD:1.0.0 >
< BUILD AT:2020_12_03_21_29_00 BY embed FOR ty_iot_wr_wf_bt_sdk_rtos AT rtl8711am_ameba >
IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 SHUTDOWN_MODE:0 LITTLE_END:1 TLS_MODE:2 ENABLE_LOCAL_LINKAGE:1 ENABLE_CLOUD_OPERATION:0 ENABLE_SUBDEVICE:1 ENABLE_ENGINEER_TO_NORMAL:0 OPERATING_SYSTEM:2 ENABLE_SYS_RPC:0 TY_SECURITY_CHIP:0 RELIABLE_TRANSFER:1 ENABLE_LAN_ENCRYPTION:1 ENABLE_LAN_LINKAGE:1 ENABLE_LAN_LINKAGE_MASTER:0 ENABLE_LAN_DEV:1 ENABLE_LAN_DEV_MASTER:0 >

[01-01 18:12:15 TUYA Debug][tuya_device.c:782] rtlam_gw_external_common_4M_iot_config_ty:1.2.8
[01-01 18:12:15 TUYA Notice][simple_flash.c:408] key_addr: 0x2ff000   block_sz 4096
[01-01 18:12:15 TUYA Err][simple_flash.c:428] key data is not matched magic(0x3a2d3e45),crc32(0xe2d8782c)
[01-01 18:12:15 TUYA Err][simple_flash.c:442] flash is encrypted or empty
[01-01 18:12:15 TUYA Err][simple_flash_app.c:286] create_flash_hand_and_init err 10
[01-01 18:12:15 TUYA Err][tuya_ws_db.c:452] db init fails -1
[01-01 18:12:15 TUYA Err][tuya_iot_com_api.c:357] db init fails -1
[01-01 18:12:15 TUYA Info][uni_thread.c:205] thread_create name:mf_test,stackDepth:5120,totalstackDepth:20480,priority:4
uart_dev_init:9600
RTL8195A[HAL]: ISR 8 had been allocated!!!
uart_dev_deinit
[01-01 18:12:16 TUYA Notice][tuya_main.c:299] mf_init succ
[01-01 18:12:16 TUYA Err][tuya_ws_db.c:324] kvs_read fails gw_bi -1
[01-01 18:12:16 TUYA Err][gw_intf.c:8890] base read err
[01-01 18:12:16 TUYA Err][tuya_device.c:800]  app_init tuya_iot_support_home_security_set err:-18
[01-01 18:12:16 TUYA Notice][tuya_device.c:676] device_init
[01-01 18:12:16 TUYA Info][uni_thread.c:205] thread_create name:ty_uart_task,stackDepth:5120,totalstackDepth:25600,priority:4
[01-01 18:12:16 TUYA Notice][weather_sever.c:430] ty_uart_public_weather_component_version:1.0.0
[01-01 18:12:16 TUYA Notice][tuya_app_gw.c:695] max num:128,sig num:32
[01-01 18:12:16 TUYA Notice][tuya_gw_baud_cfg.c:166] query baud:115200
uart_dev_init:115200
RTL8195A[HAL]: ISR 8 had been allocated!!!
uart_dev_deinit
[01-01 18:12:18 TUYA Notice][tuya_gw_baud_cfg.c:166] query baud:9600
uart_dev_init:9600
RTL8195A[HAL]: ISR 8 had been allocated!!!
uart_dev_deinit
[01-01 18:12:20 TUYA Notice][tuya_gw_baud_cfg.c:166] query baud:115200
uart_dev_init:115200
RTL8195A[HAL]: ISR 8 had been allocated!!!
uart_dev_deinit
[01-01 18:12:22 TUYA Notice][tuya_gw_baud_cfg.c:166] query baud:9600
uart_dev_init:9600
RTL8195A[HAL]: ISR 8 had been allocated!!!
uart_dev_deinit
[01-01 18:12:24 TUYA Notice][tuya_gw_baud_cfg.c:166] query baud:115200
uart_dev_init:115200
RTL8195A[HAL]: ISR 8 had been allocated!!!
tyzs3_dump.hexuart_dev_deinit
[01-01 18:12:26 TUYA Notice][tuya_gw_baud_cfg.c:166] query baud:9600
uart_dev_init:9600
RTL8195A[HAL]: ISR 8 had been allocated!!!
tyzs3_dump.hextyzs3_dump.hexuart_dev_deinit
[01-01 18:12:28 TUYA Notice][tuya_gw_baud_cfg.c:166] query baud:115200
uart_dev_init:115200
RTL8195A[HAL]: ISR 8 had been allocated!!!
  • #11 21637042
    insmod
    Level 26  
    >>21636781
    Zigbee.
    Though why tyzs3_dump.hex shows up in log several times?
  • #12 21637256
    svetlinp
    Level 8  
    Thank you for your support.
    The mistake was made when I reconnected the JTAG from the RTL8710 to the TYZS3. The positions of power and ground are opposite, so I connected the power of the JTAG to the GND of the TYZS3 and the GND of the JTAG to the 3.3V of the TYZS3. The result was expected... the power supply chip of my JTAG has to be replaced (5V -> 3.3V). But there may be more damage to the TYZS3. I don't know if it's a capacitor, a resistor, or the chip itself. The Commander does not show any suspicious output during the flash of the EFR32MG13P732F512GM48. I want to build a Zigbee gateway that is not connected to the cloud. Can I use this platform (RTL8710A) to build this gateway, or do I have to start from the beginning and buy a new device for cloud-free use? What can I use for the TYZS3 replacement on this platform, or what device is better for this purpose (cloud-free - works without Tuya or Smart Home or other services)?
    Converting WRG1 and TYZS3 Zigbee Gateways to OpenBeken
    Converting WRG1 and TYZS3 Zigbee Gateways to OpenBeken
  • #13 21637265
    insmod
    Level 26  
    >>21637256
    Well, you can repair JTAG and check if TYZS3 is alive.
    But since WRG1 is alive, TYZS3 is probably too.
    This one can be converted to be free from cloud. I've tested Zigbee2MQTT and Home Assistant ZHA, they both worked well enough. Though for WIFI+EFR32 Zigbee2MQTT is better, since they've rewrote their EZSP protocol implementation, and it is more stable.
    If you decide to buy a new device, current Tuya ones are like in https://www.elektroda.com/rtvforum/topic4127578.html
    Alternative is Ewelink. Those can also be used as bluetooth proxy. See https://www.elektroda.com/rtvforum/topic4099946.html
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

The guide details the process of converting WRG1 and TYZS3 Zigbee gateways to the OpenBeken firmware. It identifies several hardware variants compatible with this conversion, including ZXGWZ-04 (with TYGWZW1 internal board), JMWZG1 (JMZ1-V1.2 and JMZ1-V1.3), and TYZG1 (JZZWD-TY1.1). For users with the WBRG1 module, a separate reference is provided. The flashing process requires a J-Link adapter, as UART flashing is not supported; a low-cost Chinese J-Link OB clone is sufficient. Users must install the appropriate J-Link drivers (e.g., JLink_Windows_V632g.exe from rtl8711am.rar) before connecting the device. The guide includes illustrative images of the hardware and the J-Link adapter setup to assist users in the conversion process.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT