Teardown of the TH06 clock/thermometer/hygrometer and UART reverse engineering

divadiow wrote:

for sure @spin55?

I suppose that if you ask that question it is because you doubt that it is because you have problems when trying it.
The process is clearly described throughout the thread and confirmed by @Nanganator.

ah. mine is slightly different to the eMylo S09s, what was yours?

My one is like this https://www.elektroda.com/rtvforum/topic3819498.html#20672815 with IrSend now on P26 and only 1 capacitor

I could not get any life from TX/RX using any USB-TTL until I cut the TuyaMCU RX/TX. I tried many times using different cables and USB-TTLs. I have flashed quite a few Beken devices now.

Also, I note on these PWM0/P6 is the button. Maybe this variation could do with a new thread and a modified OBK to distinguish between newer S09s and the eMylos

Thanks for the great work on this - particularly the ESPHome YAML.

Update for those thinking of getting a S09 - just bought another from AliExpress, 2 weeks after my first. It came with the 2.1.17 firmware and can't be exploited by tuya-cloudcutter - so it's back to the soldering iron. There's no visable difference between the packaging or exterior of the S09, so good luck!

Hi All

This thread was essential to getting my S09 unit working. Just writing to share what I've learned.

Was able to use Cloud Cutter for mine:
- 2) Flash 3rd Party Firmware
- By manufacturer/device name
- Tuya Generic
- IR Remote Control with Temperature and Humidity Display
- 1.1.80 - BK7231T / bk7231t_common_user_config_ty (the only option)
- OpenBK7231T_UG_1.17.689.bin (the firmware I downloaded for this device)

It took a little bit of playing around to find exactly what to select, so hopefully this helps you out. Hopefully there is still stock of the non patched firmware out there.
CC is a good option here, as the UART pins are used for the TuyaMCU connection and so corruption is likely unless you desolder the Tuya board or the MCU.

My config files are:

The eMylo guy has IR send on pin 14, which was incorrect for my unit. I can confirm IR works completely.
Here is a good example of how to use the IR functionality, which I relied upon to get it working https://community.home-assistant.io/t/sending-ir-codes-on-openbeken/763475

autoexec.bat

Note: I am in Australia, so timezone is +10hrs and 192.168.4.45 is the IP of my HomeAssistant computer which runs its own NTP server (so that internet is not required to sync time)

I noticed it was over-reading temperature like others have experienced. The AHT10 is read digitally and is supposedly factory calibrated, and so poor design is all I could think was effecting the reading. So I experimented isolating the sensor and providing it better air flow.
I noticed that there is a cut out on the PCB which is great. I added a couple of layers of double sided tape, which is essentially just 1ish mm thick foam, for insulation

You can see I also drilled holes for better air flow into the sensor capsule

I then sat all the temperature sensors I had available together with a fan for an hour or so and checked that the readings had all stabalised

You will notice that during the experiment it under-reads by roughly 0.5 degC.
I found a nice little trinket I can stand it on that gives clearance between the sensor capsule and the shelf below, allowing for better airflow. In this configuration it again over reads by about a degree

So I presume there is a small amount of localised heating occurring in the sensor. I do note the in the AHT10 data sheet the relative humidity performance is specified at 1m/s aiflow.

So thats it. The display is accurate enough for me, I probably won't correct for it in HA either as I am more interested in long term trends. Its a good attractive little unit and I like the time sync capability and date display.

Unfortunately it doesn't look like the IR drivers support my Mitsubishi Electric air conditioner

Flashed up three more. I wired one of to run outside.
Inductive charging through a window



Added after 31 [minutes]:

This is how they track over 20 or so hours

Thank you for detailed writeup. I can see that one shows 22.0, second 22.3, and third 22.6. So I think it can be fairly said that precision after the decimal point is questionable.

Or maybe they are affected by the way they are placed?

I have received device with CB3S module. Optically it looks the same. Is this also supported?

>>20555058 hello which chip do you have in your S09? Mine is CB3S which is N type. Do you have different type since you flash T firmware?