Hello. Here I will present a quick test and teardown of the Tuya TH06 LCD clock/thermometer/hygrometer powered by USB. I will briefly explain how to pair with the phone, show the functionality of the mobile application, and then I will proceed to tear down part, and last, but not least, I will describe the reverse engineering process of its UART communication protocol. The UART protocol turns out to be not human-readable because it's binary, but I will explain how to handle that and extract information about the date and time.
Purchase of a TH06 calendar / thermometer / hygrometer This product is available in many stores, including on Alie ~, but I bought it myself on a slightly different website for about 20$ - PLN 80:
Offer name (use this to search for this product):
Tuya WIFI Temperature Humidity Smart Sensor Clock Digital Display Remote Control Thermometer Support Alexa Google Assistant - Type A It can also be easily found under the entry "TH06":
Parameters according to the seller:
DC 5V / 1A
2.4G IEEE 802.11 b / g / n
Temperature Measure Range
0 ? -60 ?
? 1 Humidity
0% RH ~ 99% RH
? 1% RH
Size 65 * 65 * 17mm / 2.5 * 2.5 * 0.6in
Promotional graphics illustrate its operation (and information that it provides in the phone application):
Sellers emphasize that the product is available in two versions. The second, black version, additionally supports IR control and is called S09:
Kit contents, first impression The set came in a flat box:
Product code: SKUH77374
The product model (TH06) is also printed on the packaging.
Contents (USB cable is included, but it's a power-only cord, without Data lines):
There is a micro USB connector on the back, device has no batteries, it must be constantly connected to USB 5V in order to work. This flap is just a leg:
There is also a RESET button:
The product does not remember the date / time after it is turned off. The current time is taken by the WiFi network from Web. It needs to be paired beforehand, so you need to use your phone and the SmartLife application.
Pairing is very simple, I have already covered it many times in this series. According to the instructions, we press RESET longer, we provide information about our WiFi in the app ...:
Added (the temperature shows high, because I heated it with a lamp to check the reaction time - it is quite fast):
Android application and its possibilities I have already described it several times, so here I just emphasize that the application offers a really wide range of possibilities for creating automation and work scenarios. We can trigger events with temperature, humidity, and even (I don't know why) by changing the format of the displayed temperature (F or C). We can condition events with the current time of the day, with the states of other devices, etc.
We have AND and OR logical operations available, we have delays.
Below is a collection of application screenshots:
Also, of course, there is history and charts:
Power consumption from USB The display current consumption is not high. USB Doctor was unable to record it at all:
For this reason, I measured it with a multimeter. During operation (after downloading the date from the Internet) it fluctuates between 20mA and 30mA:
The average output is 0.15W (+ power supply losses).
Similar product but battery powered It is worth noting that if we do not want to display the current date, we have many different options to choose from, they can be easily found under the entry "tuya lcd thermometer" and the like:
This round one, TS0201 RSH-Z-Bee-HS01, is on the Zigbee, I've already described it:
Interior of the TH06 The housing is latched. It must be undermined:
There is quite a lot of electronics inside:
The heart of the device is the Tuya WB3S WiFi module:
Unfortunately, it is not based on ESP. We will not be able to upload Tasmota (although you can convert it to ESP12F, desolder and solder ESP ...)
The WB3S is based on the 32-bit BK7231T. WB3S offers 1T1R WLAN module, 256-KB SRAM, 2MB flash memory and rich peripherals.
However, the WB3S itself does not support this device. Next to it is a chip in SOIC that looks like a microcontroller, but unfortunately is not signed.
In addition, we have the LCD driver, TM1621B:
The production system of Titan Micro Electronics. It is powered with the voltage of 2.4-5.2V. Here in the SSOP48 housing. Supports a display up to 32 by 4 segments.
Of course, there is also a temperature / humidity sensor on the board. This is a very popular AHT10:
Communication with AHT10 takes place via I2C:
The AHT10 can also be purchased as a separate module. It can be easily used, for example, with Arduino.
Next to AHT10 you can see a transistor signed A19T.
Maybe it's AO3401? I can see it is very popular:
This transistor is probably some part of the AHT10 circuit, I see a similar element on the modules with it.
There is of course also the power section. The characteristic large element marked 4R7 is a choke (not a resistor), it proves that there is a step down converter that converts 5V to 3.3V for the WB3S. There is also no LDO regulator in the vicinity, which also confirms the presence of a step down converter. The step down converter is more efficient than the regulator.
The step down controller is signed A121.
It's probably SY8008A / SY8008B / SY8008C. I can see that someone from the Radiokot forum was already looking for it.
It is a highly efficient, synchronous step down converter:
Pinout top view:
Sample application and charts showing efficiency:
It is also worth noting that the manufacturer has placed a large low ESR electrolytic capacitor.
Only the button remains (I do not know what these unpopulated place under Q2, Q3 are for):
Now a glance from the front.
This protruding part of the WB3S module is not a coincidence. This is where the antenna is on the board. It shouldn't be covered:
Tuya strongly recommends not to cover the antenna with a PCB. This would reduce the range / quality of the WiFi signal:
There is also a place for a mysterious element with three pin, which in my opinion would undoubtedly be an IR receiver:
So probably the second version of this product with IR uses the same board, but has an additional receiver soldered here.
Reverse engineering of the UART protocol with TH06 Inside we probably have a microcontroller that communicates with WB3S via UART. This is a fairly common solution in this type of product.
Let's try to get to know their communication protocol.
I started by locating the UART pins. That's not a problem, we have the WB3S documentation:
The picture with the leads is a view from the bottom, so looking from above we have to mirror it in our mind.
I also tracked the pins on the board:
Both RX and TX go to unknown microcontroller circuits, which is all as expected.
I soldered the cable to the TX to see what the WB3S was sending. If we wanted to replace WB3S with another module, e.g. ESP12F, we would also have to send it:
On the other hand, I led the signal to the RX of the UART adapter.
Of course, there must also be a common ground, so I also connected GND from the UART adapter.
On the computer I used RealTerm and checked roughly the more popular baud rates, hoping that the communication protocol is text.
Unfortunately, no success.
Communication appears to be binary. Although I was still considering that it is a text, but it has been scrambled with, for example, XOR before sending.
In order to finally check what the baud is, I used an oscilloscope. All you need is a single trigger and the trigger set appropriately for the oscilloscope to catch the beginning of the signal and we get:
One bit is 104us ... that's enough information for us. We can calculate baud now.
(by the way, this Rigol has the possibility to unlock the RS232 debug mode in a certain versions, but I have not tested it yet, but it should be able to automatically read the byte values from UART signal)
Baud is the number of bits per second.
1s / 104us = approximately 9600 baud.
We can also prepare a look up table beforehand to make time conversion to baud easier:
The results here are a bit rounded, if you get 108us it doesn't mean you have to count exactly and expect 9615 baud.
Equipped with the information that the baud is really 9600, I checked the communication again, this time saving the received data to a file:
In Realterm, you can save captured data to a file via the Capture tab.
I opened the file with my favorite hex editor, xvi32, which is available for free:
XVI32 has a convenient 'data inspector' that allows you to view the data value interpreted as word, dword or float.
You can see a repeating pattern in the data. Could it be packages?
The packages, however, are of different lengths. In order to facilitate further analysis, I wrote a C program to read in the data and verify whether there is a pattern repeating there.
I started by loading the file:
Log in, to see the code
Then I made a loop iterating through it byte by byte and detecting the section header:
Log in, to see the code
Then I added skipping section data. As it turned out, after the section header (two bytes, U and the value 170) there are another two bytes which probably indicate the type of section. Depending on the type of section, different data is included in the package.
Log in, to see the code
The above code correctly goes through the entire file (except for one glitch a bit further in its content, but probably because of moving the cables from the UART).
I then decided to write particular package data to separate files in some easy-to-understand form. Each package from a new line.
Log in, to see the code
Below is the result from the .txt file, with my comment (column names):
It is very clear which byte is responsible for what. Information about the current year, month, day and time data are sent as separate bytes. The tenth hour is binary 10 (not '1' '0' in ASCII, only 0x0A byte). The other values are similar.
Those repeating 0x01 may be an AM tag.
One of the values here is probably also the pairing indicator and WiFi signal strength indicator.
And the day of the week.
I don't know what the last changing value is, maybe it's some checksum, CRC to validate the packet?
The basis of the protocol is already known. I have not checked the communication the other way around, but it can be done in the same way. If the need arises, I will take care of it, and for now I will stop at this stage. You have the entire methodology of getting to know the protocol. And of course I know that you could look at XVI32 right away and not play with C processing, but it was so convenient for me and it allowed me to explore the whole thing much easier.
WB3S programming It is worth mentioning that the process of compiling the SDK for WB3S has already been briefly described by me in the topic about XR809:
https://www.elektroda.pl/rtvforum/topic3806769.html so it is probably possible to make your own firmware version for it, but more on that later.
Summary Unfortunately, there are no big revelations here. The current date along with the temperature and humidity on TH06 looks quite aesthetic, but the product also has a lot of disadvantages:
- the product requires a USB power supply (and it is often sold on the same website / offer as products very similar to it, but battery powered)
- the product does not remember the date after losing power (so if there is no electricity in the house and there is no internet, the date will not appear on it)
- the product cannot be changed to a 24h system (but the seller warns against it)
- the product is based on WB3S, there is no ESP inside, so we will not upload our own firmware
As for the pluses, I can praise the product for using a step down converter instead of LDO, always a bit more efficient. And at least the seller gave the USB cable in the set.
I am enclosing catalog notes for the elements inside and related materials, including its manual in PDF format and the UART packages I have collected (but be warned that there is some glitch at the end of the file).
Do you use this type of smart products, and if so, what specific model and in what environment? Zigbee, WiFi, Home Assistant or the manufacturer's application?