Hardware connection
Foreword
This is heavily based on the research of these tinkerers:
Serial connector
It seems that all xiaomi/Aqara/Lumi zigbee devices are based on the same MCU : NXP JN5169. This chip provide a serial interface for programming and xiaomi has been kind enough to make the pins available on a standard connector on each device. This connector is usually tagged JP1 and has 6 pins.
Here is the property of each pin:
| JN5169 | JP1 | Function |
|---|---|---|
| 28 | 1 | TXD0 |
| 29 | 2 | RXD0 |
| 22 | 3 | SPIMISO |
| 9/30 | 4 | VDD |
| 3 | 5 | RESETN |
| 21/39 | 6 | VSS |
The MCU pins relate to the following schematic:
And you will find below some examples of this connector in the xiaomi devices:
Xiaomi Smart Plug (ZNCZ02LM)
Xiaomi temperature and humidity sensor (WSDCGQ01LM)
Xiaomi Gateway V1
Physical connection to the serial interface.
Several options are available.
direct welding
Depending on the pitch between each pad of the connector, this may be quite easy or very difficult.
Some very fine wire might be required for the devices with 1.27mm pitch (most small devices)
My ugly weldings on the Gateway (2mm pitch)
Weldings on an Aqara door sensor (1.27mm pitch)
Clips
Using this clip, you can arrange a connection to the pads as long as they are spaced 1.27mm away.
Clip on a WXKG02LM
This solution is not perfect though:
- Aligning the clip and the pads is tricky. The clip may move easily during flashing.
- The clip might not be able to reach the pads for some devices where the pads are too far from the edge.
pogo pins
This is an option that i have not investigated yet, but i am pretty sure a custom connector based on pogo pins could be made for each type of sensor. That would be probably the best solution.
USB to Serial interface
Aa USB to serial interface will be required. FTDI232 is the most famous type of chip for such interface. However equivalent chip ( CP 2102 or CH340 ) might also be used. Just make sure that the chip you use is able to provide 3.3V logic level. (5V will fry your device).
You will need to connect the serial interface according to the following table:
| JN5169 | JP1 | Function | USB interface |
|---|---|---|---|
| 28 | 1 | TXD0 | RXD |
| 29 | 2 | RXD0 | TXD |
| 22 | 3 | SPIMISO | (*) |
| 9/30 | 4 | VDD | 3.3V |
| 3 | 5 | RESETN | (**) |
| 21/39 | 6 | VSS | GND |
(*) Connect this pin to ground through a pull down resistor (any resistor >1Kohm will work). When tied to ground during boot, this will force the MCU to start in programming mode. If the pin is floating or pulled-up to 3.3V, the MCU will boot normally and execute the firmware. If you plan to develop you own custom firmware, using a switch is a good idea, as you will be able to keep the serial connection while running the program to monitor the serial debugging output.
(**) You can keep this pin floating. Connecting it shortly to ground will reset (reboot) the MCU.
My quick and dirty connection
Now that everything is ready, let’s install the software