Introduction

I quickly put together this article to provide guidance on how I flashed my cheap AliExpress ZigBee Smart plug. These are also known as Tuya TS011F.

Consider this as a work in progress article.

The purpose is to fix a firmware flaw causing the plugs to turn off when reaching 251 volts. Even if this sounds like a good idea, it’s actually a problem since spikes up to 263 volts are allowed as per European quality standard (fixme, get link to specs).

Requirements

This post deals with a bunch of requirements, adapt for your own setup (spoiler : it might work, or not) :

• Home Assistant as my home automation software, mine runs as a VMware ESXi VM
  • Home Assistant built-in integration Zigbee Home Automation (ZHA)
  • Home Assistant custom HACS
    • This can be tricky, sorry I don’t give guidance in this article
  • HACS Integration ZHA Toolkit – Service for advanced Zigbee Usage
    • Some reading on HA forum : “zha-toolkit” – Toolkit providing low and high level Zigbee commands through ZHA/zigpy
• A Zigbee coordinator, I’ve used both Sonoff Zigbee Bridge (ZBBridge) (WiFi) & Sonoff ZBDongle-P (USB).

What’s your firmware?

Before flashing your plugs, you might want to know where to find the firmware version.

Navigate to Settings > Integrations and click the “xx devices” on the card.

This opens the list of all your (paired) Zigbee devices.

Filter on some keyword (mine are all named “Prise Xz”).

Note this view provides overview of Manufacturer and Model. If your plug doesn’t update, this might be related to an unknown manufacturer ID.

Firmware version is shown under Device info. If the “Firmware” line is missing, your plug hasn’t been updated..

After what, the TS011F plugs started reporting below Firmware versions:

• _TZ3000_zloso4jk : 0x0000004a
• _TZ3000_cphmq0q7 : 0x00000043
• _TZ3000_typdpbpg : 0x0000004d

Update 2023-02-03, here are updated firmware versions:

• _TZ3000_zloso4jk : 0x000000c0 -> All 5 updated fine but one had to be disconnected and re-plugged
• _TZ3000_cphmq0q7 : 0x00000043 -> None have been updated (out of 8)
• _TZ3000_typdpbpg : 0x000000c0 -> All 6 updated fine

Flashing a Zigbee plug

Send OTA notify

If you reach down to this, you are pretty well done with this.

Go to your HA instance under Developer Tools > Services (HA doc page).

From this page, you will be able to run an OTA notification using ZHA, causing the device to update.

If find it easier in YAML mode, so you can copy/paste below code. Don’t forget to change “ieee” to match the device name you want to flash.

service: zha_toolkit.ota_notify
data:
  ieee: sensor.prise_7z_boiler_electrical_measurement
  download: true
  path: /config/zb_ota

More about OTA process

The OTA process automatically checks up-to-date firmware from a JSON file compiled by contributors with URLs from vendors’ OTA (see https://github.com/Koenkk/zigbee-OTA/blob/master/index.json ).

However after update, the OTA is not triggered automatically, you must go through the process again to keep your devices up-to-date (if any firmware is available and added to the list).

Here is example for one of my devices as per Home Assistant ZHA diagnostic output, note the “manufacturer_code”.

...
  "data": {
    "ieee": "**REDACTED**",
    "nwk": 2706,
    "manufacturer": "_TZ3000_typdpbpg",
    "model": "TS011F",
    "name": "_TZ3000_typdpbpg TS011F",
    "quirk_applied": true,
    "quirk_class": "zhaquirks.tuya.ts011f_plug.Plug",
    "manufacturer_code": 4417,
...

The correct firmware is detected from manufacturerCode (dec 4417 = 0x1141).

    {
        "fileVersion": 192,
        "fileSize": 307682,
        "manufacturerCode": 4417,
        "imageType": 54179,
        "sha512": "01939ca4fc790432d2c233e19b2440c1e0248d2ce85c9299e0b88928cb2341de675350ac7b78187a25f06a2768f93db0a17c4ba950b60c82c072e0c0833cfcfb",
        "url": "https://images.tuyaeu.com/smart/firmware/upgrade/20220907/1662545193-oem_zg_tl8258_plug_OTA_3.0.0.bin"
    }

As seen in the actual firmware binary file.

For full header specs, see https://github.com/Koenkk/zigbee-OTA/blob/da29b97e10d4ec674fb6a5a6c6df311497a1a2d9/lib/ota.js#L15

Re-pair device

After update, I highly recommend you to remove and re-pair the device.

This helps having inconsistent entities. A simple “Reconfigure” doesn’t seem to be good enough.

Tip : When playing around with many devices, I always go to Developer Tools > States and search for “_2”, to prevent suffixes being added to my entities.

Is it fixed?

First, be aware some plugs seem to have a hardware / firmware issue related to power monitoring. You can clearly see on below graphs that some plugs on the left graph are reporting around 10V higher than plugs on the right.

See this comment at Tuya TS011F (TZ3000_typdpbpg) powers off #13343.

Second, I want plugs not turning off themselves (even with flashed firmware!).

I haven’t dug into this yet, however since I mostly want to use these plugs in 2 cases:

1. Control lights : So spikes during sunny day don’t matter;
2. Monitor power consumptions of major appliances : I mainly care on having plugs always on and correctly reporting power.

My choice is pretty clear: Filter on “always on”-able plugs, use the reliable power monitoring ones.

I’m left with a subset of 7 plugs out of 13.

Update 2022-12-05

Since I’ve received a third batch of the ZigBee Smart plug. It is clear they are not made equal, making them somehow unreliable, I’d have to use another sensor to compare results.

Filtering invalid values using Node-RED and SQL

Here is my “maintenance” flow. It consists of a sqlite connection running a “delete” statement every 5 minutes.

[{"id":"6cc3b15e287542b9","type":"sqlite","z":"3e3378fe315fc5da","mydb":"023d9d2edf07540e","sqlquery":"fixed","sql":"delete\nFROM \"states\"\nwhere \n  (\n    (entity_id like 'sensor.eau_en%' AND state < 0)\n    or\n    ((entity_id like 'sensor.%_super_95_e10' or entity_id like 'sensor.%_diesel_b7') and state < 0.1)\n    or\n    (\n      entity_id like 'sensor.%rms%voltage%'\n      and ((CAST(state as INT) < 190 and CAST(state as FLOAT) > 0.1) or state = 0 or state > 290)\n      and state != 'unavailable'\n    )\n    or\n    (entity_id = 'sensor.average_voltage' and state <= 190)\n  )\n;","name":"Clean invalid states","x":470,"y":120,"wires":[["63ec92685cd2573e"]]},{"id":"a905c3cbb0a04dc7","type":"inject","z":"3e3378fe315fc5da","name":"Repeat every 5 minutes","props":[],"repeat":"300","crontab":"","once":false,"onceDelay":"10","topic":"","x":230,"y":120,"wires":[["6cc3b15e287542b9"]]},{"id":"63ec92685cd2573e","type":"debug","z":"3e3378fe315fc5da","name":"SQLite Maintenance","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","statusVal":"","statusType":"auto","x":700,"y":120,"wires":[]},{"id":"023d9d2edf07540e","type":"sqlitedb","db":"/config/home-assistant_v2.db","mode":"RW"}]

Conclusion

Long story short : No, flashing your plugs might not fix your issue.

This is not an easy action, even if trivial, because it requires a lof of prerequisites that not everyone might be confortable with.

However once you unleash the power HACS, it is well worth the extra effort since that will be useful for a lot of other scenarios.