new module as remote

[boelle]

hi

this project on thingiverse https://www.thingiverse.com/thing:3655354 has been much fun to me

it was easy to remove a zigbee module from their light bulbs and then reprogramm it to work as a 5 button remote

but now ikea is slowly replacing their zigbee modules with a new one that for the bulbs concern are far more power hungry and why should ikea bother as they are intended to be always on mains power

and their new 5 button remote do not have a module at all but is one complete pcb and to top it off they now use 2 AAA batteries

that makes it impossible to install it in the danish LK Fuga design, it will simply be to big to sit flush with the other switches

anyone that have started to look in to if the new modules can be reprogrammed to work as a remote and be energy efficient so that it can run on coin cells?

i emagine that the firmware needs to be taken from the new 5 botton remote and changed so that its as efficent as possible

of course the chip on the new module an the new 5 botton remote needs to be the same

and the pcb in the new remote is way to be to be but in a LK switch, from what i have seen online its 2 cm to big in each direction

[MattWestb]

The 3 gen devices is having one very good original Silabs module that is not battery hungry.
And its also possible making custom boards for the new 4 button remote (E2001/E2002) and not using the IKEA PCB if you like but its little more tricky to flashing then its having one newer CPU (need one real J-Tag probe).

And you can using the module from other 3 gen devices if you can flashing it (the E2001/E2002 is not debug locked so its possible dumping and flashing it).

(Dumped and its have 5 buttons if counting the reset button.)

PS tuya is running 730 days on one CR2430 with one nearly the same module (ZS3L) with more LEDs on the PCB.

[boelle]

is that the new 5 botton remote?

in denmark i can only get it as a set with a bulb, but i think that will change

[boelle]

btw... i get the modules from 904.087.97

[MattWestb]

No its not the new 5 button remote then its one 4 button remote if not counting the reset button.
Its the new E2001/E2002 remote "styrbar" and the PCB is looking like this with one Silabs MG21 module.

Its very "clean" and shall being easy for the Danes making one updated PCB for that is fitting in the original deigned switch.

Your module is one ICC-A-1 = the normal 2 gen module.

[boelle]

ahh

i wonder why they changed it to 2 AAA then? ie if the power consumption is the same

[CableCatDK]

I was told the new module would spend too much power. Why else is it using 2xAAA... Maybee I sould give it a try.

[MattWestb]

I can being that IKEA devs have not maximizing the sleep current but the module / chip is very low power.

The reason for the 2 AAA shall being re chargeable and is the new green way IKEA have starting and also all new device having only recycles repairer packing (all plastic is gone).

If its little hungry put 2 CR4530 in parallel on the new PCB (some tuya is having 2 CR2032 and was having one old MG1B module).

Thanks for the PCB layout !!

[boelle]

If its little hungry put 2 CR4530 in parallel on the new PCB

remember that space is VERY limited

40x40mm and barely space for the coincell

[boelle]

currently we use OpenOCD on a pi to flash firmware

can that be used with the new remote too?

[MattWestb]

If they have adding support for ARM Cortex®-M33 the last half year but i have not reading that have being done.

The module datasheet https://www.silabs.com/documents/public/data-sheets/mgm210l-datasheet.pdf

[boelle]

i just saw that you had wires soldered to the programming header and wondered how you dumped/flashed firmware

[MattWestb]

Main flash and data is dumped without problem with Silabs WSTK (it have integrated OBD J-Tag) and Segger J-flasher and the same made with tuya ZS3L modules on LIDL device but have loading the LIDL LED stripe controller with EZSP 6.1.0.0 and is using it as one coordinator in ZHA.

(before sounding my SWD and com cables)
Its haveing the same chip and is also good calibrated and have one good implemented RF part (for being one Chinese module).

[boelle]

sorry for "stepping in a turd" here, but are there other ways to dumb the firmware?

using a raspberry pi right now with the current modules it seems costly to get a new programmer, but on the other hand i bet the one from silabs uses windows software, not that i mind linux but it could be nice to have everything on the same machine

so its a bit up in the air, nice to use the setup i have, but that means a different machine just to flash firmware, with a new setup i can use my main pc

[boelle]

being not so tech savy, i assume you use the debug connector

we use the same currently

but not sure if that would work, i do not have a one of the new modules, but @CableCatDK does

[MattWestb]

With one J-Link (every original version is working also the EDU) and you can building one "OBD clone" from one STM32 board and using it in windows but dont letting Segger updating the firmware on it then its being soft broken. Using Segger flasher and commands programs is working OK for dumping but can being it dont like flashing if having one clone or ST-Link flasher (that is ST OBD flasher only allowed flashing ST chips).
But flashing can being made with Silabs Commander that dont care if its one clone or not (its free downloading it from Silabs web).

The pins used for flashing is the same SWD for both 1 and 2 gen modules only changed is the CPU that must being supported by the probe and / or flashing software.

[boelle]

So for the danish dummie here it would make more sense to just get the WSTK programmer?

all i'm after is being able to dumb firmware from the 4 button remote and then flash it again to the same module. Thoase module i can get from mouser.

[MattWestb]

The WSTK is expensive but then you also is getting access to Silabs Zigbee stack SDK and one good thing is that with the WSTK you can also unbrick "hard software bricked devices" (boot loader flashed at wrong address with Silabs commander) that is not possible dong with other probes (i have bricking 3 IKEA modules and recovering them with my WSTK).

The cheapest is one Chinese ODB clone but dont have any grantee that is working so long (then Segger is blocking the serial numbers of them) but one Segger EDU is not so expensive and working very well and is much smaller then one WSTK.

Then dumping the flash is the main flash and also the user data that is needed then its can (but not always) having configuration for the firmware that making it working in one different way.

[CableCatDK]

First release of STYRBAR to Danish wall switch is now released:
https://www.thingiverse.com/thing:4938961
The idle power consumption is the same.

[CableCatDK]

Diagram

[MattWestb]

Very nice !!!

I think the Zigbee module is not so easy getting in the open market the IKEA, tuya Philips and many more is having high demand for it and Silabs cant producing enough of it but the have opening and certifying more productions cites the last year (if reading they internal company PM that is also distributed to devs).

Our (community) firmware cooker Gary R have ordering some hundred modules for nearly one year go and cant getting them shipped then they is out of stock before the shipping is arriving to the seller.

The cheapest device i can getting in Wien is the same new E14 or E27 you have used for 8€ and need reprogramming the module.

But i was 2 week in southern Spain for holiday and doing one "pi stop" at IKEA in Montpelier and was baying 2 stainless steel version Styrbar for only 10€ and in most countries they is costing 15€.

Great that the power consumption is OK and not killing the battery and also possible putting one large inside if needed.

Thanks for the schematics it great to having if doing one other version of one wall switch.

For dumping the firmware you can finding one version with GDB in my git but is also possible using Sergger Commander and also Silabs Commander but the last is not so easy like using the GUI from Segger Commander for normal users.

One more time great work done Per !!!

[CableCatDK]

In Denmark STYRBAR is 69 DKK, whis is 9,28 euro. The nye E14 is 59 DKK, which includes the new module. The module alone is about 100 DKK.

Reprogramming the module (in Danish with nice pictures): https://rbx.dk/w/smart-home-knapper-og-paneler/flash-ikea-zigbee-j-link.html

[MattWestb]

For my "Billy EZSP" project i was baying the cheapest "family pack" for 10€ with one E27 WW (for the module) and E1744 remote and its was very useful.

So better baying the nye clear E14 and getting little spare parts for the lab ;-))

I think IKEA was having one very hard to getting the good deal with Silabs (or it was Silabs that was having the problem getting the deal) then some FCC papers is over 2 year old with the MG21 module and they was having them on hold then was not getting one good price from Silabs but its very normal for IKEA if not getting one good deal then is normally leaving the project and taking the costs (and some time the manufacturing company is going bankruptcy then not having any large customer like one Swedish bed manufacture).

Its also looks like the SYMFONISK shall have getting one MG21 module but was getting one ICC-1-A in the end.

So very likely many Zigbee modules from IKEA lights is going to the DIY and professional projects but is not so bad !!

The latest is IKEA have ordering containers then they cant getting the products to the market then its shortages of them (Maersk ?) and is also looking baying own ships for going around the time and price of the shipping from China.

One question can you reusing the 5 switches from the Styrbar PCB to your custom PCB ?
Then its not so bad baying one Styrbar then can reusing most of the components.

[CableCatDK]

The TACH switches are different on my PCB.

[CableCatDK]

The SONOS gen2 is very similar to STYRBAR. IT has 3 more buttons, connected to PC02, PC03 and PC04.

[MattWestb]

Is it Synfonisk 2 ??
One user have getting one in thee Netherlands and in Vienna it shall coming the next week.
I dint knowing what commands is suing but its having very normal cluster for one light controller but we is knowing mor in some days :-))

[CableCatDK]

You should watch this video I made: https://youtu.be/msPRU2MsIXY

Here are the functions, when pair directly with a lightbulb:

[MattWestb]

Nice !!

So normal OnOff and Level commands plus 4 more functions IKEA have cocked in the firmware.
New version with one AAA of OnOff, ShirtCut and OpenClose is in the pipe (FCC certed).

The reset / sync of light is long press right or left button on Styrbar.

[MattWestb]

By the way OnOff and OpenClose is using the same firmware and you can dumping the flash aria "user data" and flashing it on the other and you have transforming it.

[CableCatDK]

By the way OnOff and OpenClose is using the same firmware

Very interesting. Can one change the user data over the air?

[HexDK]

By the way OnOff and OpenClose is using the same firmware and you can dumping the flash aria "user data" and flashing it on the other and you have transforming it.

you mean this?

[MattWestb]

First version of RODRET OnOff Dimmer Switch have arrived !!

6.99 € is better then the first gen buttons.

Now we must waiting @CableCatDK is baying one and using the hammer on it so we is knowing how its look inside and the PCB layout.

[MattWestb]

Sorry its no Silabs module inside they have making on compact PCB with integrated antenna and on tiny shielded very like EEFR32MG21 chip but its looks nice and cas they was not doing the same with Symfonisk 2 and Styrbar then have making them more compact. Its also looks they is having one stepup converter so can using rechargeable batteries then it shall being tricky without it getting the radio and CPUs working stable.


I is missing test pas for the chip rest that can being good to have then recover chips that have getting problems but perhaps its hidden someplace.

[MattWestb]

Was trying connecting to the debug with my Silabs WSDK but it was not liking it.
Was looking on the power and with one 1.5V battery the pads is having 2.22V so the next try was without the plus and only GND and the debug lines but still mot like talking to my.
With the old IKEA module its looks Segger have make changes and its needs the hardware rest for getting the chip in debug mode, The problem here is the we dont have the reset exposed.
In GSDK its possible using some of the debug lines for other things then booting the app and then one hardware reset is needed for hocking the chip in early stage of booting before its disabling the debug interface. I can IKEA have using that trick.

If some one have one device and one SWD debugger pleas try see if can getting contact with the chip then its more then likely on EFR32MG21 without hardware secure storage as the normal MG21 module is using but i can its have other ports that the module but its depends of the chip version used.
I have not being so brutal as our Danish friend so no hammer for getting the chip "free" yet.

[jlunz]

@MattWestb :
You can access RESETn at the following location, outside the shield can:

I tried first with a converted ST-Link to J-Link without much success.
I then used a Simplicity Link Debugger and was able to read Info etc.

Flashing the baremetal blink exampled worked without an issue.

[MattWestb]

Sound great and thanks @jlunz !!
So IKEA have labeling it GND (i was reading on my PCB but on your photo is C10) for making all creative persons not testing it !!!!
So with WSTK it was working then you also connected the chip reset ?
The good thing is looks IKEA have not debut logging your device so it shall being possible using it for future device "conversion" .
Can you reading / dumping the main flash and the user data then we can needing it for the OpenClose and shortcut buttons and perhaps is they is doing one updated valve remote.

Also most J-Link clones is not working with MG2X chips then dont have the security implanted in the debugger and if converting it with Segger its being locked to only flashing the OME (ST) chips.
WSTK is having some magic implanted so its possible recovering MG1X chips (i gave hard soft braking 3 modules but was able recovering them with the WSTK by stalling the processor with the reset).

I shall making one test dumping the flash in the weekend and reporting back.

Do you also have "found " the pin / pad function so we can see if its possible flashing it on the normal MG21 module ?

One more thanks for the great information !!!

[jlunz]

I was not completely sure if I had unlocked debug access / erased flash with my ST-Link before, so I wired up a new remote.
It seems that the device is locked, I am getting the following output. Anything I should / can try before a erase?

commander device --device EFR32MG21A010F1024IM32 info
JLinkError: Could not find core in Coresight setup
 
WARNING: Could not connect to target device
ERROR: Debug access is locked. Could not connect to device
DONE

[MattWestb]

Servus J.

OK the chip was debug locked ;-((

Can you dumping the user data flash part ?
Its holding the hard and software configuration IKEA is using for the device and with it we can using one unlocked chip and flashing one bootloader from STYRBAR and flashing the extracted OTA file and the device shall working OK (was working with Symfonisk G2).

I have not have time looking on my test device but i have 2 in production and looks working great but one LIDL / tuya power strip was playing nasty games and was destroying my production network by have power problems and one IKEA outlet and one GU10 CWS3 was repowering oft and was making device accouterments that is being badly handled by all silabs chips and must being repowered for working OK after that (shall being fixed in later Zigbee stacks).

Thanks for sharing your findings and good hacking for you.

Edit: Debug unlock is erasing the main flash and the RAM but not the user data then we have testing and looks working OK so we cant dumping the main flash but as long IKEA have not doing more trikes we can using one standard bootloader and for getting it working OK we hope.

[jlunz]

Ok, just to be sure:
I unlock:

commander device lock --debug disable

and then try to read userdata:

commander readmem --region @userdata --outfile dumpuser.hex

[MattWestb]

I think you can doing the unlock from GUI but i have not trying it and shall doing the same thing as the CLI.

I was not getting the region working but other users was having working OK so i was using memory addresses and its working the same way and shall being OK.

It can being that you need adding the standard -device EFR32MG21A010F1024IM32 so commander is knowing the chip layout or its complaining.

Out file is HEX good i normally making more formats if some its not being OK and BIN is easy reading and editing but no check for errors but all is working and can being converted with commander if the in file is OK.

[jlunz]

Here we go:
dumpuser(bin,hex,s37).zip

It has the following in:

00000000: ffff ffff ffff ffff ffff ffff ffff ffff  ................
...
000001f0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000200: 524f 4452 4554 2044 696d 6d65 72ff ffff  RODRET Dimmer...
00000210: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000220: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000230: 0145 3232 3031 ffff ffff ffff ffff ffff  .E2201..........
00000240: ffff 00e2 ffff ffff ffff ffff ffff ffff  ................
00000250: ffff ffff ffff ffff ffff ffff ffff ffff  ................
00000260: ffff ffff ffff ffff ffff 0000 ffff ffff  ................
00000270: ffff ffff ffff ffff ffff ffff ffff ffff  ................
...
000003f0: ffff ffff ffff ffff ffff ffff ffff ffff  ................

Full output, for those wanting to do the same

$ commander device --device EFR32MG21A010F1024IM32 lock --debug disable
Unlocking debug access (triggers a mass erase)...
Chip successfully unlocked.
DONE

$ commander device --device EFR32MG21A010F1024IM32 info
Part Number    : EFR32MG21A010F1024IM32
Die Revision   : A1
Production Ver : 41
Flash Size     : 1024 kB
SRAM Size      : 96 kB
Unique ID      : bc026efffecdbd07
DONE

$ commander readmem --device EFR32MG21A010F1024IM32 --region @userdata --outfile dumpuser.hex
WARNING: No serial number or IP address given, cannot lock access to adapter.
Reading 1024 bytes from 0x0fe00000...
Writing to dumpuser.hex...
DONE

[MattWestb]

Thanks its looks very good perhaps i shall flashing it one one MG21 module but i dont knowing the pinout of the paring and the up and down buttons so not so easy testing is its working more then the name is OK red.

The interesting is the 0X24x and 0X26x that is doing the hard and software settings of the device if its being one OnOff, OpenCloce or one Shortcut button.

[jlunz]

Thanks its looks very good perhaps i shall flashing it one one MG21 module but i dont knowing the pinout of the paring and the up and down buttons so not so easy testing is its working more then the name is OK red.

You're welcome!
Pinout on the E2201 is:
Red LED: LED1 / PD00
Button "0": S1 / PA04
Button "∞": S2 / PA06
Button "1": S3 / PA03

[MattWestb]

Thank one more time i shall look if the information and doing some digging and test.
The MGM210L is having all pins / pads but the PA06 is not led to one pad so its shall working for all functions but its not possible pairing the module with that firmware but can perhaps being done with one other like Styrbar and then flashing only the OTA file so the NVM blocks is not erased but its little work testing if its working OK.

By the way then you have getting the blink working, then is you releasing your multi functions firmware for the device with okta button press and so on ???? ;-)

[CableCatDK]

How do you pull a button? On STYRBAR it is short to GND. But on SYMFONISK it is short to PA03.

[MattWestb]

S2 Pairing is shutting to GND but the other 2 is not GND but can being VSS after the voltage regulator then its not + from the battery. Must looking more.

Edit: S3 is using the same 2 liens as LED1 and no GND is being used for it so must using shifting polarity or shutting the LED for the button press.
Non of the 2 liens is being used for S1 that must using other logic.
Also from the VDD test pas is not contact to the swishes.

Edit 2 Updating my observations and test:
All swishes is shutting to GND also the LED is having GND on the negative side so its no magic here only that the chip is using 3 pins for waking up from sleep.

[MattWestb]

I have unpacking the OTA file from TF OTA-feed and converting it to GBL, S37 and BIN if some one like trying recreating one working device by first flashing one working boot loader and then the "APP".
E2201-OTA.zip
Try first with one STYRBAR bootloader then its one of the latest not locked we have dumped that was working OK with Symfonisk 2.

[MattWestb]

I was testing connecting the PCB with my WSDK and also shouldering the reset cable and i was miss interpreting the commander then its writing "could not connect to target device" but after little trixing i cant getting the MAC and the secure elements stratus.

That is true then the MCU is not online then the chip is debug locked and we can only talking with the security processor and getting the status from the secure elements but with that we is getting the status we like / need.
I also have long long cables so some time i must putting the SWD speed down from 8000 for getting it working but must testing if reading the memory map and flashing is working for knowing its OK speed.
Also its looks like the reset is not needed for getting this information but have not testing doing on unlock if its working OK without it and also getting it flashing working OK.

Then i have time i shall trying flashing the user data and the patched main flash and testing if i can getting it to work on one MG21 chip without IKEAs locked chip.

[CableCatDK]

@MattWestb I dumped 47 x ICC-A-1 from different devices. I might be useful.
IKEA_ICC-1_ICC-A-1_dump.zip

[MattWestb]

Great thanks !!!

I have not time but i thinking doing one coordinator as i have doing with the first and second gen module of the Rodret remote it shall not being any large problem only finding the right pins on the chop and soldering cables. I can that the RP part is limited RF power but is the same with the modules the is not using the max for getting stability and one symmetric RF link.

Have you thinking doing one switch by cutting of the PCB and connecting your switches instead of the Silabs module ?

[CableCatDK]

Have you thinking doing one switch by cutting of the PCB and connecting your switches instead of the Silabs module ?

I have not rally looked into the Rodret remote. Its large size only fits 1M5 FUGA modules (68mm high). For that size you really want at least 6 buttons, not only 2. So maybe one could flash to SYMFONISK firmware on it. Then make a daughterboard with 6-8 buttons. The result would be a 1M5 FUGA switch which uses 1xAAA batteri, but requires space behind it.

My current SYMFONISK to FUGA conversion uses 2xCR2032, and can be mounted directly on the wall.

Alkaline AAA: 860–1,200 mAh
CR2032: 220 mAh

[MattWestb]

Rodret PCB is having one buck converter (FCC papers is saying its 2 different types is being used) but i think its not working with CRXXXX cells and putting in one AAA is taking too much space so no go.
The module is using one different MG21 chip that is using different ports so can being its not working but i have not testing it serious only fast flashing it and its not running on the module.

[CableCatDK]

@MattWestb The firmware is very picky about module types. I bought MGM210LA22JNF2 instead of MGM210L022JNF2, and the firmware is not working.

[MattWestb]

Its not so well documented but the A version think have hardware secure storage (vault) and the = is having software or not implanted.
I think the firmware is working on both but need one updated bootloader for stating the app or its cant starting then it cant getting the secure storage.

[MattWestb]

@jlunz Do you knowing the ports the RX and TX TP/Pads is using ?
I trying doing one UART bootloader and cooking one NCP / RCP firmware for using it as one coordinator and have 2 extra E2213 that i have sounding cables on and like trying if its working OK.
Also shall trying "converting" OnOff to ChortCut and back.

[jlunz]

@MattWestb I have made a quick protoype to use EmberZNet on a E2201, so you can check the pinout here (and maybe the software as well):
https://github.com/jlunz/silabs-firmware-builder/blob/jl%2Fadd_e2201_rodret/EmberZNet%2FE2201_Rodret%2F0001-configure-usart-vcom-for-e2201_rodret.patch

Here is the traced pcb:

Hope that helps!

[MattWestb]

Thanks i shall trying cooling one UART bootloader with TX C00 / RX C01 and see if i can getting it working OK then it shall being possible doing NCP and RCP / Thread firmware for it.

I have doing debug unlock on both Rodret and Somerig and then flashing Styrbars main flash for getting one "IKEA Bootloadre" and then the latest OTA and it working OK.
Only if flashing Rodret on Somrig its start sending light commands and also to group 0 but is keeping Somrig as device type so need update the user data if like getting it working 100%. I diont knowing if OTA is working on the unlocked / converted devices but Symfonisk 2 was working OK.

Thanks Julian for info i reporting back if all is going well !!

[MattWestb]

Have one 4.4.0.0 / 7.4.0.0 X-modeme bootloader that looks loading OK and terminal commands looks working OK.

Gecko Bootloader v2.04.00
1. upload gbl
2. run
3. ebl info
BL >
Gecko Bootloader v2.04.00
1. upload gbl
2. run
3. ebl info
BL >

Also was putting in Button "∞": S2 / PA06 (GPIO activation) but have not testing if its right polarity (low or high) that can only being tested then one app is running OK or its always going into the bootloder.
Pleas testing if its working if you have time and we can start trying cooking NCP and RCP firmware for the device.
IKEAMG21-BL-4400.zip

[MattWestb]

Fast cooked NCP 7.4.0.0 with only hardware configured (SW flow control enabled) and i can being flashed from the bootloader and is starting OK and i can controlling one IKEA GU10 WW and one parasoll re-joined OK so its working but its not god configured but as one prof of consent its OK.
IKEAMG21-ncp-uart-4400.zip

[MattWestb]

RCP 4.4.0.0 115200 baud no FC, only tested with universal-silabs-flasher but looks working OK also testing the bootloader button:

(311) PS C:\msys32\Portainer\belloows\311> universal-silabs-flasher --device com9 probe
2024-01-19 13:42:15.362 MW-E3222 universal_silabs_flasher.flasher INFO Probing ApplicationType.GECKO_BOOTLOADER at 115200 baud
2024-01-19 13:42:17.364 MW-E3222 universal_silabs_flasher.flasher INFO Probing ApplicationType.CPC at 460800 baud
2024-01-19 13:42:21.623 MW-E3222 universal_silabs_flasher.flasher INFO Probing ApplicationType.CPC at 115200 baud
2024-01-19 13:42:21.654 MW-E3222 universal_silabs_flasher.flasher INFO Detected ApplicationType.CPC, version '4.4.0' at 115200 baudrate (bootloader baudrate None)

(311) PS C:\msys32\Portainer\belloows\311> universal-silabs-flasher --device com9 probe
2024-01-19 13:43:08.282 MW-E3222 universal_silabs_flasher.flasher INFO Probing ApplicationType.GECKO_BOOTLOADER at 115200 baud
2024-01-19 13:43:09.320 MW-E3222 universal_silabs_flasher.flasher INFO Detected bootloader version '2.4.0'
2024-01-19 13:43:09.320 MW-E3222 universal_silabs_flasher.flasher INFO Detected ApplicationType.GECKO_BOOTLOADER, version '2.4.0' at 115200 baudrate (bootloader baudrate 115200)

IKEAMG21-rcp-uart-4400.zip