[BK7231T WB3S] UltraPro WFD4001 3-Way Smart Wall Switch
The UltraPro WFD4001 is a 120V 3-way Wifi smart switch under the UltraPro brand of Jasco. It uses a WB3S Tuya chip, which can be exploited over the air using Tuya-Cloudcutter.
Purchase link: Amazon
Manufacturer Instructions: UltraPro WFD 4001
Alternate Wiring: Alternate Wiring
Product Image:
Teardown:
This is pretty easy to get into, just pop off the front switch cover by pulling on the tabs on either side. Once the front cover is off, you can easily get to the 4 triangle screws (not sure the proper name of these, but I happened to have a bit in a precision screwdriver set from Klein). Once these are removed, the entire metal faceplate can be easily removed.
The board is split into two parts that I will call the control board and the power board. Both of these boards can be removed by just pulling them out, no other screws or tabs are holding them in, although the power board is held in a little bit by the screws terminals, but these can be pushed out from the side. The control board sits on top and has the WB3S chip, as well as the up and down buttons. This is connected to the power board via a 6-pin header, so be careful to pull the control board straight out so the pins don't get bent. A closer look at the 6-pins has them labeled as REL, 5V, GND, 3-WAY, ZEROX, and NC. The REL is also labeled as PWM in some spots - I'm not sure if this is because it terminates to a PWM pin on the WB3S chip, or if there is some other functionality that I don't know about. I could not find where the NC and ZEROX pins go to, so I'm not sure what they are used for. The NC doesn't seem to go anywhere on the board, but the ZEROX looks to be connected to a few components.
The power board has an 0B2222MCP chip which is described as a "PWM Power Switch", but I'm not sure if there is anything useful for us here.
As mentioned earlier, this device can be exploited with tuya-cloudcutter. There is already a device-profile available for it making the conversion pretty easy.
Because this switch has 2 buttons, the config has a bit more steps than normal, but not too bad.
Settings:
You will need to create some event handlers to properly handle the buttons. I did this by creating an autoexec.bat file with the following code:
3-Way:
I still haven't figured this out yet, but here is the progress that I've made. Using a multimeter, I determined that the 3-WAY pin connects directly to the ADC3 pin on the WB3S module (0Ω). It looks like the 3-WAY pin also goes to a KL4 chip which looks to be an ADC chip as well, but I couldn't find where it goes from here. When I set the ADC3 pin to ADC mode and put it on its own channel, I can get some values, but nothing that is exactly usable to control the 3-way function. When the traveler wire is low, the ADC values hover in the range of 15-27. When the traveler is high (120V), the ADC output seems to slowly go from the same low range, all the way to 4095 which I assume is the max that can be measured, but then falls back to the low values. It just cycles from low to high indefinitely. I tried watching all of the other pins to see if anything happens when I switch the traveler, but so far I haven't found anything. I don't think I wired anything incorrectly, as I tried the same configuration with a stock switch and it worked fine with the traveler.
Not sure if anyone has experience with something similar, but any help figuring this out would be much appreciated!
Purchase link: Amazon
Manufacturer Instructions: UltraPro WFD 4001
Alternate Wiring: Alternate Wiring
Product Image:
Teardown:
This is pretty easy to get into, just pop off the front switch cover by pulling on the tabs on either side. Once the front cover is off, you can easily get to the 4 triangle screws (not sure the proper name of these, but I happened to have a bit in a precision screwdriver set from Klein). Once these are removed, the entire metal faceplate can be easily removed.
The board is split into two parts that I will call the control board and the power board. Both of these boards can be removed by just pulling them out, no other screws or tabs are holding them in, although the power board is held in a little bit by the screws terminals, but these can be pushed out from the side. The control board sits on top and has the WB3S chip, as well as the up and down buttons. This is connected to the power board via a 6-pin header, so be careful to pull the control board straight out so the pins don't get bent. A closer look at the 6-pins has them labeled as REL, 5V, GND, 3-WAY, ZEROX, and NC. The REL is also labeled as PWM in some spots - I'm not sure if this is because it terminates to a PWM pin on the WB3S chip, or if there is some other functionality that I don't know about. I could not find where the NC and ZEROX pins go to, so I'm not sure what they are used for. The NC doesn't seem to go anywhere on the board, but the ZEROX looks to be connected to a few components.
The power board has an 0B2222MCP chip which is described as a "PWM Power Switch", but I'm not sure if there is anything useful for us here.
As mentioned earlier, this device can be exploited with tuya-cloudcutter. There is already a device-profile available for it making the conversion pretty easy.
Because this switch has 2 buttons, the config has a bit more steps than normal, but not too bad.
Settings:
| Pin # | Pin Name | Description | Settings |
| P8 | PWM2 | Up Button | Btn_ScriptOnly |
| P9 | PWM3 | Down Button | Btn_ScriptOnly |
| P24 | PWM4 | Front LED | LED or LED_n |
| P26 | PWM5 | Switch Relay | Rel |
You will need to create some event handlers to properly handle the buttons. I did this by creating an autoexec.bat file with the following code:
addEventHandler OnClick 8 setChannel 1 1
addEventHandler OnClick 9 setChannel 1 03-Way:
I still haven't figured this out yet, but here is the progress that I've made. Using a multimeter, I determined that the 3-WAY pin connects directly to the ADC3 pin on the WB3S module (0Ω). It looks like the 3-WAY pin also goes to a KL4 chip which looks to be an ADC chip as well, but I couldn't find where it goes from here. When I set the ADC3 pin to ADC mode and put it on its own channel, I can get some values, but nothing that is exactly usable to control the 3-way function. When the traveler wire is low, the ADC values hover in the range of 15-27. When the traveler is high (120V), the ADC output seems to slowly go from the same low range, all the way to 4095 which I assume is the max that can be measured, but then falls back to the low values. It just cycles from low to high indefinitely. I tried watching all of the other pins to see if anything happens when I switch the traveler, but so far I haven't found anything. I don't think I wired anything incorrectly, as I tried the same configuration with a stock switch and it worked fine with the traveler.
Not sure if anyone has experience with something similar, but any help figuring this out would be much appreciated!
Comments
Very interesting research. I've been testing Intertek TreatLife 3-way switch, SS02 (FCC ID 2ANIFSS01), and I quickly realized that in case of this device, the stair function is made by using both relay... [Read more]
I actually have a few of the older Treatlife SS01 switches that still used the TYWE3S module, so I was able to flash Tasmota onto them. I believe they are basically rebrands of this MOES 3-way switch ... [Read more]
If you want to replace just one of two switches, then you really need to have some mechanism to determine whether the light is currently on or off. so we would basically need some kind of driver... [Read more]
This switch works a bit differently from the one that you have, it only has a single relay and a single traveler line, so the switch is able to reliably/accurately report its state (the one relay output... [Read more]
That code would not work for two reasons. 1. you need to first save ADC value to channel, and use channel with given index and not "ADC" as variable 2. the changes are quick and change handlers don't... [Read more]
Oh right, in my testing I did assign the ADC value to a new channel, I was just trying to make the code clear that I was using the ADC value. Before you invest time in developing a new driver for this... [Read more]
I've worked on that about a week or two ago and added lfs_append, etc commands so scripts can log to files but I don't think so they are reliable when you need to log things so often. That could work if... [Read more]
Ya that makes sense, I don't think MQTT would be great for logging multiple times a second either, but I should be able to get a value every 1-2 seconds which might be enough to tell what's going on. As... [Read more]
I know its been a little while, but I finally had a little more time to play with this switch, and I have an update! I feel a little silly that I didn’t try this earlier, but if you set the ADC pin... [Read more]
I hope 6 months isn't too long to bring a thread back to life, but I recently bought and flashed one of these WFD4001 switches, and I think I have some new data and insights to bring to the topic. After... [Read more]
There isn't, but maybe I can add something like that for you? Here's a draft: https://github.com/openshwprojects/OpenBK7231T_App/commit/9366190698506990f7e84b0c08cb535c7a53fe5c I will expand this... [Read more]
Those seem reasonable. Maybe also a flag to choose smoothing algorithm between avg and max? [Read more]
I am adding it as a separate driver, not as a core feature. So not a flag, but maybe a command param. The question is, once I determine whether the given value on ADC is high or low, what do I have... [Read more]
This is great! It's funny just 2 days I started looking at this again and noticed the same thing when I tried the AB_Map, glad to see all of the progress made on OpenBeken! My initial thought was to... [Read more]
Sorry, yes, I meant a "flag" argument to the driver, not a core flag. We're on the same page there. If we're exporting the value to a channel, being able to detect change on that channel should be enough... [Read more]
Maybe a command could look like that? // ADCSmoother [Pindex] [TotalSamples] [SampleIntervalMS] [TargetChannelADCValue] [MarginValue] [TargetChannel0or1] //... [Read more]
Looks good. Happy to give it a spin on my device, though it may have to wait for the weekend. [Read more]
I pushed untested version, usage: StartDriver ADCSmoother // ADCSmoother [Pindex] [TotalSamples] [SampleIntervalMS] [TargetChannelADCValue] [MarginValue] [TargetChannel0or1] ADCSmoother... [Read more]
Wow! About 10 minutes of tuning and I think I have a decent config, although I probably need a bit more time to make sure it behaves like I want. Here's the code I added to my startup: StartDriver... [Read more]