Smart home
  • Register

As I wanted to control my blinds and curtains via HomeAssistant, I have decided to order this MS-108ZR module:

moeshouse zigbee rf433 smart curtain switch moduleIt's a module from MoesHouse with the possibility to control via ZigBee, Hard switch and RF remote control. The RF remote is a perfect feature (from my point of view), because a cable connected wall swicth installation would not be easy in one of my rooms. Plus I don't need to get my phone, start homeassistant interface and select the apropriate page for controlling blinds.

 

 

 

 

 

 

 

I don't have an TuYa ZigBee Gateway and i'm using zigbee2mqtt for my ZigBee devices.

The device is identified in zigbee2mqtt as TuYa TS130F and the OPEN/CLOSE and STOP functions work fine, setting to requested position also works fine. One thing doesn't work - the calibration. By default, the opening and closing times are cca 10 seconds. If you have smaller or bigger shutter/curtain then the calibration is important. 

The device should be tuya compatible and by looking in to the module, we can see, it's using the Tuya ZS2S module for ZigBee communication.

Dz1WF2MdM v3.0Dz1WF2MdM v3.0ms108zr2

The main board is labelled Dz1WF2MdM v3.0 and I think, Moes could be using the same board also for WiFi version of this curtain controller. The RF part is connected via daughter board (Dz1WF1CurS v1.2) in my case with two boards on it  - the mentioned ZS2S module for Zigbee and one RF module (Dz1WF1CurW v1.0). There is also one switch, that is used for RF link & Zigbee pairing

ms108zr4ms108zr5

Button functions

  • Press 5 times - pairing OPEN button (RF433)
  • Press 6 times - pairing CLOSE button (RF433)
  • Press 7 times - pairing STOP button (RF433)
  • Press more than 7 times - Reset WiFi method? maybe Zigbee 
  • Press for more than 7 seconds to enter into Zigbee pairing mode.

Dz1WF1CurW v1.0

The RF board has 6 soldering contacts and is based on a Synoxo SYN590R (marked as U3 on the board), which is a ASK/OOK RF Receiver (http://www.synoxo.com/syne/product.php?flm=6&lm=9&zlm=12). There is also another chip, marked as U2, an SO8 packaging, but the marking is either covered or removed. 

ms108zr6

 I have decided, that this is not worth further reverse-engineering if we have a another way to get it working...

Zigbee sniffing 

Yes, this is the easier way. But we will need a tuya zigbee gateway, so I have ordered one and had to wait for it - it took very long but it came.

What do you need? Pretty much everything is very goog described here: zigbee2mqtt :: How to sniff Zigbee traffic - i strongly recommend visiting & reading this.

With tuya gateway and a cc2531 stick flashed with sniffing firmware, I installed requred software and started my (short) work.

whsniff -c 20 | wireshark -k -i -

I also had to find the right channel, so I have paired the Curtain module with my Gateway and was going channel-by channel up to channel #20 where I found the communication - hence the -c 20 parameter.

I did not see any usable data, because I did not have the encryption key, but that we'll get there... Now, I removed the device from tuya gateway (unpaired it) and with sniffer stick connected, whsniff & wireshark running, I continued.

Zigbee key

When you can sniff the pairing process, the key can be found in the Device Announcement packet:

zigbee_sniffing-1-key

You just need to copy & add it to the keys for zigbee protocol:

zigbee_sniffing-2-key

And now we should see correctly decoded data.

As I have alredy mentioned, this module was supported via zigbee2mqtt, but it was incorrectly identified as TuYa TS130F

 

 zigbee_sniffing-3-identification

As we can see, the device indeed anounces itself as a TS130F - would not be a problem if it would be 100% compatible, but it is not.

Let's not waste time and try to set the Calibration Time from Tuya App. This is what I got after setting 90s (seconds) in calibration:

zigbee_sniffing-4a-traveltime-90s

So there was a write attribute request, where the attribute was 0xf003 and value 900. Tha value was then automatically reported on line 1234:

zigbee_sniffing-5a-traveltime-90s-reported

Just to be sure, I changed the calibration time to 50s and got this:

zigbee_sniffing-4-traveltime-50s

Again - Attribute is 0xf003 and the value is number_of_seconds * 10.

Just to be sure, I have tried to change an attribute, that is already working via zigbee2mqtt:

zigbee_sniffing-6-motorreversation

And that was the motor reversation - attribute 0xf002.

Now I just needed to implement it into the zigbee-herdsmann-converters, test it and create a pull request. Meanwhile, I have published my changes for people waiting to get the calibration working here