Tuya T3E - 480*480 Screen - Zigbee Reverse Engineering

rtorrente · February 12, 2026, 9:32am

The Tuya T3E is a display with a relay compatible with European mount boxes, containing an ESP32 inside, even though it is sold as a module compatible only with Zigbee.

I recently managed to find the pinouts to make the screen, touchscreen, and relays work in the same way as the well-known GUITION screen.
The configuration is pending publication on https://devices.esphome.io/. (PR available here: TuYa T3E - ESP32 480*480 Smart Screen by rtorrente · Pull Request #1458 · esphome/esphome-devices · GitHub)

However, the module also contains a TUYA ZT3L Zigbee module that appears to be connected to the ESP-32 and could be useful as a Zigbee router to take advantage of the powered device to improve network mesh coverage.
At the moment, I haven’t been able to figure out the connections between the ESP-32 and the module, which appear to be located on the back of the PCB and i’m looking for help.

I found the ZT3L module Datasheet : ZT3L Module Datasheet-Tuya Developer Platform-Tuya Developer

Here are the screen pcb photos :

On the ESP 32, the only ports not used by other components (screen, touch, relay) are:

GPIO 1
GPIO 5
GPIO 19
GPIO 20
GPIO43 - TXD
GPIO 44 - RXD

On the electronic board, several pins on the ZT3L appear to be connected together, but I don’t understand why.

If it is possible to detect the pins used for communication between the ESP 32 and the ZT3L, it will probably be possible to use the specifications of this communication protocol to activate pairing and router mode on the Zigbee card : Serial Communication Protocol-MCU Standard Protocol-Tuya Developer

I would be very happy to complete the reuse of this screen on ESPHome and receive help with this Zigbee module.

Karosm · February 12, 2026, 10:54am

Are you sure of that?
Just looking at the pcb-traces only two pins are connected and go under esp module low right corner. So they likely go to 19/20 or more likely 43/44. Check continuity with multimeter.

Sure that esp lower right pins are occupied?

zoogara · February 12, 2026, 11:26am

Do what @Karosm suggested - break out the multimeter and see where those 2 pins go. They appear to be the TX and RX of the ZT3L.

rtorrente · February 12, 2026, 12:12pm

Thanks both for your replies, @Karosm and @zoogara. I’m impressed you saw this wiring just with my picture.

I have run multimeters, and you are right, here is the updated pinout:

Z3TL RX is wired to GPIO 19 ESP32
Z3TL TX is wired to GPIO 20 ESP32

Firstly, thanks for your help with this first step!

So I just added this block on my esphome yaml:

uart:
  tx_pin: GPIO20
  rx_pin: GPIO19
  data_bits: 8
  baud_rate: 115200
  parity: NONE
  stop_bits: 1
  debug:
    direction: BOTH
    dummy_receiver: false
    after:
      delimiter: "\n"
    sequence:
      - lambda: UARTDebug::log_string(direction, bytes);

But nothing happens. I just tried with BAUD_RATE 9600 and same, nothing output.

I made the following checks:

3,3V and GND of Z3TL are well at 3,3V when board is on
Nothing happens if I shortly put Z3TL RST to GND.

Docs seems to say " The Zigbee module supports two baud rates: 9600 bps and 115200 bps. The module supports automatic baud rate detection. Upon initial power up, it alternates between 9600 bps and 115200 bps. When the MCU responds at one of these rates, the module saves and configures that rate." but maybe i’m missed something ?

Karosm · February 12, 2026, 1:20pm

Not all devices are talking “by themself”. It likely wants esp to open the conversation…

robertklep · February 12, 2026, 1:24pm

Have you tried this? Tuya MCU - ESPHome - Smart Home Made Simple

Karosm · February 12, 2026, 1:32pm

In UART rx goes to tx and tx to rx.
And how you verified which one is which?

rtorrente · February 12, 2026, 1:45pm

Yes I know for RX et RX inversion. If i’m not wrong, i setup that in the code tx is set to GPIO20 (The RX of ZT3L)

I check with multimeter, there is a continuity between ZT3L TX port and GPIO 19, and continuity between ZT3L RX port and GPIO 20

rtorrente · February 12, 2026, 1:46pm

Yes, but the doc say that :

Each time the Zigbee module is powered on, it sends this command to the MCU, which must respond before sending any other commands to the module. Product information consists of the product ID and the MCU software version number. The Zigbee module also uses this command to check the MCU’s baud rate during their initial communication.

Karosm · February 12, 2026, 1:51pm

My question was, how you know that the zt3l pin is tx and not rx?

Also, how are you logging it?
According to esphome docs, default logging on S3 is on pins 19/20…

rtorrente · February 12, 2026, 2:41pm

Ah yes sorry I see your point, I suppose that by reading the ZT3L datasheet but effectively i can’t confirm on the firmware.

Yes UART Logger is disabled and I use the logger via esphome interface

So I managed to have answer on the serial port but it’s very strange.

I need to setup the Tuya Integration. if setup the Tuya Integration, I receive the famous " Query product information (0x01)" command sent by the zigbee module.

[15:32:31.815][D][uart_debug:113]: <<< 55:AA:02:1E:65:01:00:00:85
[15:32:32.818][D][uart_debug:113]: <<< 55:AA:02:1E:66:01:00:00:86
[15:32:33.825][D][uart_debug:113]: <<< 55:AA:02:1E:67:01:00:00:87
[15:32:34.817][D][uart_debug:113]: <<< 55:AA:02:1E:68:01:00:00:88
[15:32:35.820][D][uart_debug:113]: <<< 55:AA:02:1E:69:01:00:00:89
[15:32:36.823][D][uart_debug:113]: <<< 55:AA:02:1E:6A:01:00:00:8A
[15:32:37.816][D][uart_debug:113]: <<< 55:AA:02:1E:6B:01:00:00:8B
[15:32:38.825][D][uart_debug:113]: <<< 55:AA:02:1E:6C:01:00:00:8C
[15:32:39.824][D][uart_debug:113]: <<< 55:AA:02:1E:6D:01:00:00:8D
[15:32:40.828][D][uart_debug:113]: <<< 55:AA:02:1E:6E:01:00:00:8E
[15:32:41.829][D][uart_debug:113]: <<< 55:AA:02:1E:6F:01:00:00:8F
[15:32:42.826][D][uart_debug:113]: <<< 55:AA:02:1E:70:01:00:00:90
[15:32:43.820][D][uart_debug:113]: <<< 55:AA:02:1E:71:01:00:00:91
[15:32:44.818][D][uart_debug:113]: <<< 55:AA:02:1E:72:01:00:00:92
[15:32:45.130][D][uart_debug:113]: >>> 55:AA:00:00:00:00:FF
[15:32:45.437][D][uart_debug:113]: >>> 55:AA:00:00:00:00:FF
[15:32:45.717][D][uart_debug:113]: >>> 55:AA:00:00:00:00:FF
[15:32:45.835][D][uart_debug:113]: <<< 55:AA:02:1E:73:01:00:00:93
[15:32:46.155][D][uart_debug:113]: >>> 55:AA:00:00:00:00:FF
[15:32:46.457][D][uart_debug:113]: >>> 55:AA:00:00:00:00:FF
[15:32:46.664][E][tuya:504]: Initialization failed at init_state 0
[15:32:46.826][D][uart_debug:113]: <<< 55:AA:02:1E:74:01:00:00:94
[15:32:47.820][D][uart_debug:113]: <<< 55:AA:02:1E:75:01:00:00:95
[15:32:48.820][D][uart_debug:113]: <<< 55:AA:02:1E:76:01:00:00:96
[15:32:49.828][D][uart_debug:113]: <<< 55:AA:02:1E:77:01:00:00:97
[15:32:50.834][D][uart_debug:113]: <<< 55:AA:02:1E:78:01:00:00:98
[15:32:51.819][D][uart_debug:113]: <<< 55:AA:02:1E:79:01:00:00:99
[15:32:52.840][D][uart_debug:113]: <<< 55:AA:02:1E:7A:01:00:00:9A
[15:32:53.834][D][uart_debug:113]: <<< 55:AA:02:1E:7B:01:00:00:9B
[15:32:54.828][D][uart_debug:113]: <<< 55:AA:02:1E:7C:01:00:00:9C
[15:32:55.829][D][uart_debug:113]: <<< 55:AA:02:1E:7D:01:00:00:9D
[15:32:56.828][D][uart_debug:113]: <<< 55:AA:02:1E:7E:01:00:00:9E
[15:32:57.829][D][uart_debug:113]: <<< 55:AA:02:1E:7F:01:00:00:9F
[15:32:58.835][D][uart_debug:113]: <<< 55:AA:02:1E:80:01:00:00:A0
[15:32:59.832][D][uart_debug:113]: <<< 55:AA:02:1E:81:01:00:00:A1
[15:33:00.141][D][uart_debug:113]: >>> 55:AA:00:00:00:00:FF
[15:33:00.446][D][uart_debug:113]: >>> 55:AA:00:00:00:00:FF
[15:33:00.733][D][uart_debug:113]: >>> 55:AA:00:00:00:00:FF
[15:33:00.847][D][uart_debug:113]: <<< 55:AA:02:1E:82:01:00:00:A2
[15:33:01.157][D][uart_debug:113]: >>> 55:AA:00:00:00:00:FF
[15:33:01.460][D][uart_debug:113]: >>> 55:AA:00:00:00:00:FF
[15:33:01.652][E][tuya:504]: Initialization failed at init_state 0

Tuya component not support this zigbee module communication so effectively init fail but the strange thing is that with the component, the module start to speak.
Without it does not, even if i send command to the uart.

I’m going to check the tuya component code to see if there is a init command that can start the communication.

robertklep · February 12, 2026, 2:51pm

Here’s where the serial protocol seems to be documented: Docs Center-Tuya Developer

It’s different (but similar) to the protocol used by Tuya WiFi modules, which is why the Tuya MCU component doesn’t work.

rtorrente · February 13, 2026, 8:47am

Here’s the news. I started writing a small component based on the TuYa component to try to communicate with the ZT3L.

I am able to receive requests for information from the Zigbee module and respond to them, but it seems to keep requesting them over and over again. That doesn’t seem to be written that way in the specification. I wonder if the module is continuously rebooting.
When I query “Query module’s network status,” I receive a response of “0x01,” which means “Connected, indicating that the device has been added to a Zigbee network.”

I try to send 0x03 to start pairing, the zigbee module ack the request but i see nothing pairing in my zigbee2mqtt.
If I check more the information :

If i request mode “0x00: Reset and restart” : Module ack and restart (few second with no logs) and start query again the module info in loop
If I request mode “0x01: Leave the current network and join a new one”, module ack and I receive immediatly a network status update with “Network error.”. But when I query the network status again it’s in “Connected”.

This leads me to believe that the module keeps rebooting because it doesn’t like the response during the preliminary negotiation (product ID, etc.)?

To be continued …

[zigbee_router:070]	 Received frame - CMD: 0x01, SEQ: 0x005B, Data len: 0
09:32:29	[I]	[zigbee_router:083]	Module requesting product info (0x01)
09:32:29	[D]	[uart_debug:113]<<< 55:AA:02:00:5B:01:00:00:5D
09:32:29	[I]	[zigbee_router:124]	Sent product info response: {"p":"fj5fqeg9","v":"1.0.0","g":1,"s":1,"lp":0}
09:32:29	[D]	[uart_debug:113]	>>> 55:AA:02:00:5B:01:00:2F:7B:22:70:22:3A:22:66:6A:35:66:71:65:67:39:22:2C:22:76:22:3A:22:31:2E:30:2E:30:22:2C:22:67:22:3A:31:2C:22:73:22:3A:31:2C:22:6C:70:22:3A:30:7D:2E
09:32:30	[D]	[zigbee_router:070]	Received frame - CMD: 0x01, SEQ: 0x005C, Data len: 0
09:32:30	[I]	[zigbee_router:083]	Module requesting product info (0x01)
09:32:30	[D]	[uart_debug:113]	<<< 55:AA:02:00:5C:01:00:00:5E
09:32:30	[I]	[zigbee_router:124]	Sent product info response: {"p":"fj5fqeg9","v":"1.0.0","g":1,"s":1,"lp":0}
09:32:30	[D]	[uart_debug:113]	>>> 55:AA:02:00:5C:01:00:2F:7B:22:70:22:3A:22:66:6A:35:66:71:65:67:39:22:2C:22:76:22:3A:22:31:2E:30:2E:30:22:2C:22:67:22:3A:31:2C:22:73:22:3A:31:2C:22:6C:70:22:3A:30:7D:2F
09:32:30	[D]	[zigbee_router:170]	Querying network status (0x20)
09:32:30	[D]	[uart_debug:113]	>>> 55:AA:02:00:5B:20:00:00:7C
09:32:30	[D]	[zigbee_router:070]	Received frame - CMD: 0x20, SEQ: 0x005B, Data len: 1
09:32:30	[I]	[zigbee_router:088]	Module responding to network status query (0x20)
09:32:30	[I]	[zigbee_router:145]	Zigbee module network status: CONNECTED (0x01)
09:32:30	[D]	[uart_debug:113]	<<< 55:AA:02:00:5B:20:00:01:01:7E
09:32:31	[D]	[zigbee_router:070]	Received frame - CMD: 0x01, SEQ: 0x005D, Data len: 0
09:32:31	[I]	[zigbee_router:083]	Module requesting product info (0x01)

.....

When I request pairing

[09:41:45.602][D][button:022]: 'Zigbee Leave Join' Pressed.
[09:41:45.607][I][zigbee_router:205]: Reset/Pairing mode requested (0x03)
[09:41:45.614][D][uart_debug:113]: >>> 55:AA:02:00:58:03:00:01:01:5E
[09:41:45.627][D][zigbee_router:070]: Received frame - CMD: 0x03, SEQ: 0x0058, Data len: 0
[09:41:45.632][D][zigbee_router:083]: Data: <empty>
[09:41:45.637][D][zigbee_router:099]: Unhandled command: 0x03
[09:41:45.642][D][zigbee_router:070]: Received frame - CMD: 0x02, SEQ: 0x028B, Data len: 1
[09:41:45.647][D][zigbee_router:081]: Data (hex): 02
[09:41:45.652][D][zigbee_router:099]: Unhandled command: 0x02
[09:41:45.747][D][uart_debug:113]: <<< 55:AA:02:00:58:03:00:00:5C:55:AA:02:02:8B:02:00:01:02:93
[09:41:45.763][D][zigbee_router:070]: Received frame - CMD: 0x01, SEQ: 0x028C, Data len: 0
[09:41:45.770][D][zigbee_router:083]: Data: <empty>
[09:41:45.780][I][zigbee_router:089]: Module requesting product info (0x01)
[09:41:45.788][D][uart_debug:113]: <<< 55:AA:02:02:8C:01:00:00:90
[09:41:45.806][I][zigbee_router:130]: Sent product info response: {"p":"fj5fqeg9","v":"1.0.0","g":1,"s":1,"lp":0}
[09:41:45.906][D][uart_debug:113]: >>> 55:AA:02:02:8C:01:00:2F:7B:22:70:22:3A:22:66:6A:35:66:71:65:67:39:22:2C:22:76:22:3A:22:31:2E:30:2E:30:22:2C:22:67:22:3A:31:2C:22:73:22:3A:31:2C:22:6C:70:22:3A:30:7D:61
[09:41:46.421][D][zigbee_router:176]: Querying network status (0x20)
[09:41:46.440][D][uart_debug:113]: >>> 55:AA:02:00:59:20:00:00:7A
[09:41:46.453][D][zigbee_router:070]: Received frame - CMD: 0x20, SEQ: 0x0059, Data len: 1
[09:41:46.460][D][zigbee_router:081]: Data (hex): 01
[09:41:46.460][I][zigbee_router:094]: Module responding to network status query (0x20)
[09:41:46.460][I][zigbee_router:151]: Zigbee module network status: CONNECTED (0x01)

rtorrente · February 14, 2026, 12:21pm

It’s finally working.

On the product initialisation, I was trying to send s and lp where the doc statted :

Note that this configuration is only supported by the TuyaOS merged version firmware

When I removed this two value, the query loop stop immediatly and I was able to send pairing command and pair to zigbee2mqtt. The module seems to not be the “TuyaOS firmware”

I choose an arbitrary “T-ZB-RT” for name for “Tuya Zigbee Router” but length was limited.

Now I just have to :

Write a small esphome component to handle this zigbee router with status, and pairing command and publish to github
Write a small zigbee2mqtt definition for the router

Thank you all for the support when reading the wiring

Karosm · February 14, 2026, 7:00pm

Nice job!!

rtorrente · February 14, 2026, 7:45pm

Here is a first basic working solution of the esphome component to start the zigbee module as a router : GitHub - rtorrente/esphome-tuya-zigbee-router

zoogara · February 15, 2026, 7:13am

I wonder if this will work with the T2E as well. Not that I have the cash spare for one of those - but…

rtorrente · February 15, 2026, 7:54am

T2E is linux based with Android installed on it. It’s not esp based so it will not work immediatly.

If there is a zigbee chip on it (i’m not sure), it’s possible to use same uart commands to make a small linux program and do the same

zoogara · February 16, 2026, 2:17am

Ah - I’m glad someone was paying attention…

rtorrente · February 21, 2026, 4:34pm

Complete device configuration including relay, touchscreen and zigbee router is now merged and available on esphome devices : TuYa T3E - ESP32 480*480 Smart Screen | ESPHome Devices

Thanks all for your help on the wires findings !