I suppose that if you ask that question it is because you doubt that it is because you have problems when trying it.
The process is clearly described throughout the thread and confirmed by @Nanganator.
I could not get any life from TX/RX using any USB-TTL until I cut the TuyaMCU RX/TX. I tried many times using different cables and USB-TTLs. I have flashed quite a few Beken devices now.
Also, I note on these PWM0/P6 is the button. Maybe this variation could do with a new thread and a modified OBK to distinguish between newer S09s and the eMylos
Thanks for the great work on this - particularly the ESPHome YAML.
Update for those thinking of getting a S09 - just bought another from AliExpress, 2 weeks after my first. It came with the 2.1.17 firmware and can't be exploited by tuya-cloudcutter - so it's back to the soldering iron. There's no visable difference between the packaging or exterior of the S09, so good luck!
This thread was essential to getting my S09 unit working. Just writing to share what I've learned.
Was able to use Cloud Cutter for mine:
- 2) Flash 3rd Party Firmware
- By manufacturer/device name
- Tuya Generic
- IR Remote Control with Temperature and Humidity Display
- 1.1.80 - BK7231T / bk7231t_common_user_config_ty (the only option)
- OpenBK7231T_UG_1.17.689.bin (the firmware I downloaded for this device)
It took a little bit of playing around to find exactly what to select, so hopefully this helps you out. Hopefully there is still stock of the non patched firmware out there.
CC is a good option here, as the UART pins are used for the TuyaMCU connection and so corruption is likely unless you desolder the Tuya board or the MCU.
Note: I am in Australia, so timezone is +10hrs and 192.168.4.45 is the IP of my HomeAssistant computer which runs its own NTP server (so that internet is not required to sync time)
I noticed it was over-reading temperature like others have experienced. The AHT10 is read digitally and is supposedly factory calibrated, and so poor design is all I could think was effecting the reading. So I experimented isolating the sensor and providing it better air flow.
I noticed that there is a cut out on the PCB which is great. I added a couple of layers of double sided tape, which is essentially just 1ish mm thick foam, for insulation
You can see I also drilled holes for better air flow into the sensor capsule
I then sat all the temperature sensors I had available together with a fan for an hour or so and checked that the readings had all stabalised
You will notice that during the experiment it under-reads by roughly 0.5 degC.
I found a nice little trinket I can stand it on that gives clearance between the sensor capsule and the shelf below, allowing for better airflow. In this configuration it again over reads by about a degree
So I presume there is a small amount of localised heating occurring in the sensor. I do note the in the AHT10 data sheet the relative humidity performance is specified at 1m/s aiflow.
So thats it. The display is accurate enough for me, I probably won't correct for it in HA either as I am more interested in long term trends. Its a good attractive little unit and I like the time sync capability and date display.
Unfortunately it doesn't look like the IR drivers support my Mitsubishi Electric air conditioner
Thank you for detailed writeup. I can see that one shows 22.0, second 22.3, and third 22.6. So I think it can be fairly said that precision after the decimal point is questionable.
Or maybe they are affected by the way they are placed?
The discussion centers on the teardown and UART reverse engineering of the Tuya TH06 LCD clock/thermometer/hygrometer, specifically the S09 model variant with integrated IR functionality. Key points include the binary UART protocol decoding, where temperature and humidity data packets were identified and analyzed. The TuyaMCU firmware command for setting the device datetime (command 0x1C) was examined, with source code references from OpenBK7231T firmware provided to illustrate the time update process. Challenges were noted in sending the datetime update command via Tasmota firmware due to boot loops and configuration resets, partly attributed to desoldering the WB3S chip and differences in protocol expectations. IR receiver and emitter pins were identified (GPIO5 and GPIO14 on ESP12F), with successful IR control demonstrated. Flashing the device with OpenBeken firmware using tuya-cloudcutter was detailed, including backup and write commands, and configuration snippets for temperature and humidity channels. Calibration limitations were discussed, as the temperature sensor is directly connected to the TuyaMCU, preventing LCD temperature calibration via WiFi module firmware. Later device versions with AHT20 sensors and modified IR pin assignments (PWM5/P26) were reported, along with ESPHome integration examples. Users shared experiences with firmware versions that resist flashing due to security patches, requiring soldering interventions. The thread also covers practical advice on flashing techniques, hardware modifications (resistors for ESP8266 pins), and the impact of device placement on sensor precision. Overall, the conversation provides a comprehensive technical overview of hardware teardown, UART protocol reverse engineering, firmware flashing, and integration challenges for the Tuya TH06/S09 smart sensor device. Summary generated by the language model.
