logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda
Give yourself a gift! »
Give yourself a gift! » Print 3D • Smart Home • Flipper
ADVERTISEMENT

Teardown of the TH06 clock/thermometer/hygrometer and UART reverse engineering

p.kaczmarek2 23160 41

TL;DR

  • Teardown of the Tuya TH06 USB clock/thermometer/hygrometer, plus reverse engineering of its UART communication and SmartLife pairing.
  • Inside are a WB3S BK7231T Wi‑Fi module, an unnamed SOIC microcontroller, a TM1621B LCD driver, an AHT10 sensor, and a step-down power stage.
  • Measured current draw stays around 20–30 mA after network time sync, about 0.15 W, and the seller price was about $20 / PLN 80.
  • UART traffic runs at 9600 baud and uses binary packets that expose year, month, day, hour, minute, and likely AM/Wi‑Fi status and checksum fields.
  • The clock needs constant USB 5V, forgets time after power loss, cannot switch to 24-hour format, and cannot run Tasmota because it lacks ESP.
Generated by the language model.
ADVERTISEMENT
This content has been translated flag-pl » flag-en View the original version here
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • #31 20958242
    spin55
    Level 17  
    divadiow wrote:
    for sure @spin55?


    I suppose that if you ask that question it is because you doubt that it is because you have problems when trying it.
    The process is clearly described throughout the thread and confirmed by @Nanganator.
  • ADVERTISEMENT
  • #32 20958605
    divadiow
    Level 38  
    ah. mine is slightly different to the eMylo S09s, what was yours?

    My one is like this https://www.elektroda.com/rtvforum/topic3819498.html#20672815 with IrSend now on P26 and only 1 capacitor

    I could not get any life from TX/RX using any USB-TTL until I cut the TuyaMCU RX/TX. I tried many times using different cables and USB-TTLs. I have flashed quite a few Beken devices now.

    Also, I note on these PWM0/P6 is the button. Maybe this variation could do with a new thread and a modified OBK to distinguish between newer S09s and the eMylos
  • ADVERTISEMENT
  • #34 21061247
    newtoboards
    Level 1  
    Thanks for the great work on this - particularly the ESPHome YAML.

    Update for those thinking of getting a S09 - just bought another from AliExpress, 2 weeks after my first. It came with the 2.1.17 firmware and can't be exploited by tuya-cloudcutter - so it's back to the soldering iron. There's no visable difference between the packaging or exterior of the S09, so good luck!
  • ADVERTISEMENT
  • #35 21226801
    randomalias324
    Level 8  
    Hi All

    This thread was essential to getting my S09 unit working. Just writing to share what I've learned.

    Was able to use Cloud Cutter for mine:
    - 2) Flash 3rd Party Firmware
    - By manufacturer/device name
    - Tuya Generic
    - IR Remote Control with Temperature and Humidity Display
    - 1.1.80 - BK7231T / bk7231t_common_user_config_ty (the only option)
    - OpenBK7231T_UG_1.17.689.bin (the firmware I downloaded for this device)

    It took a little bit of playing around to find exactly what to select, so hopefully this helps you out. Hopefully there is still stock of the non patched firmware out there.
    CC is a good option here, as the UART pins are used for the TuyaMCU connection and so corruption is likely unless you desolder the Tuya board or the MCU.

    My config files are:
    Code: text Expand Select all Copy to clipboard
    {
  "vendor": "Tuya",
  "bDetailed": "0",
  "name": "Full Device Name Here",
  "model": "enter short model name here",
  "chip": "BK7231T",
  "board": "TODO",
  "flags": "1024",
  "keywords": [
    "TODO",
    "TODO",
    "TODO"
  ],
  "pins": {
    "8": "IRRecv;0",
    "26": "IRSend;0"
  },
  "command": "",
  "image": "https://obrazki.elektroda.pl/YOUR_IMAGE.jpg",
  "wiki": "https://www.elektroda.com/rtvforum/topic_YOUR_TOPIC.html"
}

    The eMylo guy has IR send on pin 14, which was incorrect for my unit. I can confirm IR works completely.
    Here is a good example of how to use the IR functionality, which I relied upon to get it working https://community.home-assistant.io/t/sending-ir-codes-on-openbeken/763475

    autoexec.bat
    Code: text Expand Select all Copy to clipboard
    startDriver TuyaMCU
startDriver NTP
ntp_setServer 192.168.4.45
ntp_timeZoneOfs 10:00
setChannelType 1 temperature_div10
linkTuyaMCUOutputToChannel 101 val 1
setChannelType 2 Humidity
linkTuyaMCUOutputToChannel 102 val 2

    Note: I am in Australia, so timezone is +10hrs and 192.168.4.45 is the IP of my HomeAssistant computer which runs its own NTP server (so that internet is not required to sync time)

    I noticed it was over-reading temperature like others have experienced. The AHT10 is read digitally and is supposedly factory calibrated, and so poor design is all I could think was effecting the reading. So I experimented isolating the sensor and providing it better air flow.
    I noticed that there is a cut out on the PCB which is great. I added a couple of layers of double sided tape, which is essentially just 1ish mm thick foam, for insulation
    Circuit board with visible components placed on a laptop keyboard Close-up view of the circuit board of an electronic device with LEDs and ventilation holes. Image showing a plastic device casing with drilled holes.
    You can see I also drilled holes for better air flow into the sensor capsule
    Person holding a black device with an open flap next to a silver electronic device.
    I then sat all the temperature sensors I had available together with a fan for an hour or so and checked that the readings had all stabalised
    Several temperature displays showing readings from 19.0°C to 19.6°C.
    You will notice that during the experiment it under-reads by roughly 0.5 degC.
    I found a nice little trinket I can stand it on that gives clearance between the sensor capsule and the shelf below, allowing for better airflow. In this configuration it again over reads by about a degree
    Two devices with LCD displays showing different temperature readings on a desk.
    So I presume there is a small amount of localised heating occurring in the sensor. I do note the in the AHT10 data sheet the relative humidity performance is specified at 1m/s aiflow.

    So thats it. The display is accurate enough for me, I probably won't correct for it in HA either as I am more interested in long term trends. Its a good attractive little unit and I like the time sync capability and date display.

    Unfortunately it doesn't look like the IR drivers support my Mitsubishi Electric air conditioner :(
  • #36 21275077
    randomalias324
    Level 8  
    Flashed up three more. I wired one of to run outside.
    Inductive charging through a window
    Wireless charger in packaging on a light background.
    Inductive charger mounted on a window with tape Table with an electronic device and tape, next to a window with cables inside.

    Added after 31 [minutes]:

    This is how they track over 20 or so hours
    Several electronic devices on a desk, including three digital thermometers.
    Temperature graph with three lines showing indoor and outdoor measurements.
  • #37 21275594
    p.kaczmarek2
    Moderator Smart Home  
    Thank you for detailed writeup. I can see that one shows 22.0, second 22.3, and third 22.6. So I think it can be fairly said that precision after the decimal point is questionable.

    Or maybe they are affected by the way they are placed?
    Helpful post? Buy me a coffee.
  • #38 21467333
    cijoml
    Level 9  
    I have received device with CB3S module. Optically it looks the same. Is this also supported?
  • #39 21468515
    cijoml
    Level 9  
    >>20555058 hello which chip do you have in your S09? Mine is CB3S which is N type. Do you have different type since you flash T firmware?
  • #40 21701556
    p.kaczmarek2
    Moderator Smart Home  
    It should work with CB3S. I got new one. I'm not sure which model is it. Here is backup:
    https://github.com/openshwprojects/FlashDumps/commit/9edf7768970f021546d38e3e1c44d3a49a55fd6e
    BK7231N_QIO_TemperatureAndHumidityLCDSensorTuyaMCU_2025-26-9-18-53-15.bin

    Managed to read without desoldering MCU:
    Teardown of the TH06 clock/thermometer/hygrometer and UART reverse engineering
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #41 21706226
    cijoml
    Level 9  
    >>21701556 my model S09 is written at plastic back side of the device
  • #42 21878449
    Rocky_0x4e
    Level 1  
    I'm probably late to the game, but I just want to put it out there for anyone who's looking for an answer about the inaccurate temperature reading on the thermometer.

    If anyone notices the inaccurate temperature on your display, enabling PowerSave would help a lot.
    Because PowerSave is off by default, and it causes the MCU to heat up, which would affect the temp sensor.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion centers on the teardown and UART reverse engineering of the Tuya TH06 LCD clock/thermometer/hygrometer, specifically the S09 model variant with integrated IR functionality. Key points include the binary UART protocol decoding, where temperature and humidity data packets were identified and analyzed. The TuyaMCU firmware command for setting the device datetime (command 0x1C) was examined, with source code references from OpenBK7231T firmware provided to illustrate the time update process. Challenges were noted in sending the datetime update command via Tasmota firmware due to boot loops and configuration resets, partly attributed to desoldering the WB3S chip and differences in protocol expectations. IR receiver and emitter pins were identified (GPIO5 and GPIO14 on ESP12F), with successful IR control demonstrated. Flashing the device with OpenBeken firmware using tuya-cloudcutter was detailed, including backup and write commands, and configuration snippets for temperature and humidity channels. Calibration limitations were discussed, as the temperature sensor is directly connected to the TuyaMCU, preventing LCD temperature calibration via WiFi module firmware. Later device versions with AHT20 sensors and modified IR pin assignments (PWM5/P26) were reported, along with ESPHome integration examples. Users shared experiences with firmware versions that resist flashing due to security patches, requiring soldering interventions. The thread also covers practical advice on flashing techniques, hardware modifications (resistors for ESP8266 pins), and the impact of device placement on sensor precision. Overall, the conversation provides a comprehensive technical overview of hardware teardown, UART protocol reverse engineering, firmware flashing, and integration challenges for the Tuya TH06/S09 smart sensor device.
Generated by the language model.
Today's popular

FAQ

TL;DR: Average TH06/S09 draw is 25 mA at 5 V (≈0.15 W) and “flashing was disgustingly easy!” [Elektroda, p.kaczmarek2, #19532446; Nanganator, #20575359]. Cloud-cutter works on firmware ≤1.1.80, but 2.1.17 units need wired flashing.

Why it matters: Knowing the hardware limits and flash paths saves hours of trial-and-error.

Quick Facts

• Supply: 5 V DC, 20–30 mA running, 0.15 W typical [Elektroda, 19532446] • Sensors: AHT10 or AHT20, ±0.3 °C, ±2 % RH accuracy (datasheet) • UART link: 9600 bps, 8 N 1, header 0x55 0xAA [Elektroda, 19532446] • IR pins: P14 (older S09) or P26 (new PCB) for transmit; P8/PWM2 for receive [Elektroda, #20672815; #20359963] • Exploit: tuya-cloudcutter supports WB3S firmware ≤1.1.80; CB3S/N firmware ≥2.1.17 unpatchable OTA [Elektroda, post #21061247]

How do I flash TH06/S09 without soldering?

Use tuya-cloudcutter: 1. Select profile “Tuya Generic – IR Remote Control with Temperature and Humidity Display”. 2. Pick firmware 1.1.80 (BK7231T). 3. Upload OpenBeken or ESPHome binary. Success confirmed on three units [Elektroda, 21226801] Edge-case: devices shipped with 2.1.17 fail the exploit and require UART flashing [Elektroda, post #21061247]

What UART settings are needed for manual protocol sniffing?

Set the adapter to 9600 bps, 8 data bits, no parity, 1 stop bit. The packet header is 0x55 0xAA followed by a two-byte command type [Elektroda, 19532446]

Which command updates the on-board clock?

Send 55 AA 00 1C 00 08 [valid-flag YY MM DD hh mm ss dow] CHK. Example for 2022-12-30 12:28 Friday: 55 AA 00 1C 00 08 01 16 0C 1E 0C 1C 00 05 8F [Elektroda, 20359449]

I only get temperature and humidity once per minute—is that normal?

Yes. The Tuya MCU pushes dpIDs 101 (temperature×10) and 102 (humidity %) roughly every 60 s to the Wi-Fi SoC [Elektroda, 20359249]

Why are my readings 1 – 2 °C high?

The sensor sits above warm components; users measured +1.3 °C bias indoors [Elektroda, 20577583] Adding insulation tape and drilling vent holes cut the error to ≈0.5 °C [Elektroda, post #21226801]

Can I calibrate the LCD reading?

No. Temperature is read directly by the Tuya MCU, which also drives the LCD. The Wi-Fi module cannot overwrite that value [Elektroda, 20606693]

Does OpenBeken support the CB3S (BK7231N) version?

Yes, OBK builds tagged “UG” work on BK7231N. Flash via UART because current cloud-cutter scripts target BK7231T only [Elektroda, 21467333]

Do I need to cut PCB tracks to flash over UART?

Usually not. Hold CEN low, power-cycle, then run uartprogram to back-up and write the image. Two resistors on GPIO0 and 15 may be added for ESP12F swaps but are unnecessary for WB3S/CB3S [Elektroda, 20555058]

What pins handle IR on the new AHT20 board?

Receive: P8 (IRRecv). Transmit: P26 (IRSend). Older S09 boards used P14 for transmit [Elektroda, 20672815]

How do I send an IR code from Home Assistant?

  1. Map P26 (or P14) as IRSend in OBK or ESPHome.
  2. Publish MQTT: cmnd/<device>/IRSend 0xE0E040BF for Samsung power, for example [Elektroda, 20672815]

Is the project suitable for beginners?

Yes. One user with “limited skills” flashed four units successfully; flashing time averaged 5 minutes per device [Elektroda, 20556332]

What is the power cost of running the clock 24/7?

At 0.15 W continuous draw, annual energy use is about 1.3 kWh—less than US$0.25 at $0.19 /kWh [Elektroda, 19532446]

How do I correct sensor offsets in Home Assistant?

Template: 

value_template: "{{ (value|float*0.1-1.3)|round(1) }}"
adds a −1.3 °C correction. Humidity uses +3.6 [Elektroda, 20577583]

What fails most often during flashing?

Units shipped with patched firmware (≥2.1.17) reject OTA exploit; flashing stalls at 0 %. Wired UART solves it but voids warranty [Elektroda, 21061247]

Can I display custom text on the LCD?

No. The TM1621B driver is controlled only by the Tuya MCU; Wi-Fi firmware has no access to segment data [Elektroda, 19532446]

Quick 3-step UART flashing guide

  1. Short CEN to GND, power the board, release.
  2. Run: python uartprogram OpenBK7231T_UA.bin -d COMx -w.
  3. Power-cycle; connect to the new AP and configure pins [Elektroda, 20555058]
Generated by the language model.
ADVERTISEMENT