Klarstein Wonderwall bk7231n

Hi,
First time poster so be gentle 🙂
I've got a pair of wonderwall smart heaters that use tuya. They have a CBU board in them and I have flashed a few of these before using other people's methods.
How would I go about creating a config for them once they're flashed? How would I work out the pinout?
Plan B is to just gut the device and use a ZigBee switch and an external temperature sensor to control them.
Any help would be really appreciated, this forum has saved me so many times already!

Added after 45 [seconds]:

Sorry for the terrible photos, can get better ones tomorrow.

Hello, it should be easy to support that device, I can write a custom driver for you if that's needed, but I need your assistance to know the hardware details.

First of all, do you a have a multimeter? Just a simple one featuring continuity test (beep mode).

I need to know which CBU pins are connected where.

Can you do some kind of sketch, or do annotations on the photo?

Maybe start with relay... or buttons...

Doing a better quality PCB photos (not blurry!) will also work.

Here's the CBU pinout:

Pin number	Symbol	I/O type	Function
1	P14	I/O	Common GPIO, which can be reused as SPI_SCK (Correspond to Pin 11 of the IC)
2	P16	I/O	Common GPIO, which can be reused as SPI_MOSI (Correspond to Pin 12 of the IC)
3	P20	I/O	Common GPIO (Correspond to Pin 20 of the IC)
4	P22	I/O	Common GPIO (Correspond to Pin 18 of the IC)
5	ADC	I/O	ADC, which corresponds to P23 on the internal IC (Correspond to Pin 17 of the IC)
6	RX2	I/O	UART_RX2, which corresponds to P1 on the internal IC. (Correspond to Pin 28 of the IC)
7	TX2	I/O	UART_TX2, which is used for outputting logs and corresponds to P0 of the internal IC (Correspond to Pin 29 of the IC)
8	P8	I/O	Support hardware PWM (Correspond to Pin 24 of the IC)
9	P7	I/O	Support hardware PWM (Correspond to Pin 23 of the IC)
10	P6	I/O	Support hardware PWM (Correspond to Pin 22 of the IC)
11	P26	I/O	Support hardware PWM (Correspond to Pin 15 of the IC)
12	P24	I/O	Support hardware PWM (Correspond to Pin 16 of the IC)
13	GND	P	Power supply reference ground
14	3V3	P	Power supply 3V3
15	TX1	I/O	UART_TX1, which is used for transmitting user data and corresponds to Pin 27 of the IC. For the MCU solution, please refer to CBx Module.
16	RX1	I/O	UART_RX1, which is used for receiving user data and corresponds to Pin 26 of the IC. For the MCU solution, please refer to CBx Module.
17	P28	I/O	Common GPIO (Correspond to Pin 10 of the IC)
18	CEN	I/O	Reset pin, low active (internally pulled high), compatible with other modules (Correspond to Pin 21 of the IC)
19	P9	I/O	Common GPIO (Correspond to Pin 25 of the IC)
20	P17	I/O	Common GPIO, which can be reused as SPI_MISO (Correspond to Pin 14 of the IC)
21	P15	I/O	Common GPIO, which can be reused as SPI_CS (Correspond to Pin 13 of the IC)
Test point	CSN	I/O	Mode selection pin. If it is connected to the ground before being powered on, enter the firmware test mode. If it is not connected or connected to VCC before being powered on, enter the firmware application mode. Correspond to Pin 19 on the internal IC.

Really struggling, had a quick probe around with the multimeter and can't find anything connected to the CBU at all!

@gangle well you can always desolder the CBU... but I assume you want easier route?

Well, okay, then do this: open OpenBK page, and in Configure Device, set few pins to relays, each on different channel, like that:

then try toggling relay on channel 0 (in this case P0 pin) - check if something happens and write down result.
Then try toggling relay on channel 1 (in this case P1 pin) - check if something happens, again, write down result..
Then... do the same for remaining channels.
Write down result.
Then, finally, remove Relay roles from P0 to P4, and add those roles to P5, P6, etc... again, set channels, 0, 1, 2, 3.... and try toggling.

By doing this for each pin, you may determine some of the IO roles. For example, you may be able to determine which pin is buzzer, which is relay (?), which is heater.... it's a brute-force approach, but it works.

BTW, just to be sure - there is nothing under 7-segment display, right? No hidden MCU?

There does seem to be lots of traces on the PCD running under the 7segment so I assume there is something under there!

That's a great approach, I'll give that a go! Thanks for helping!

Please report your results here. Futhermore, you could use the same approach for buttons - for example, set each pin role to dInput (or just to Btn) and press and observe for changes in channel (linked channel, channels are used to pair relays and buttons or dInputs ,etc)

So far I have found out the relay is pin 20!
The only other thing I'd really like is to find the thermistor but I think that might be beyond me!

Added after 4 [minutes]:

Is there any way to use the original firmware to find anything out?

Maybe... do you have an original firmware backup?

Wait, isn't thermistor on ADC pin? Just set ADC role and check the readings of ADC pin to linked channel and check if it reacts with temperature?

I do have the firmware and that is probably the way to go I think, it seems that the device turns on and off for short bursts to make sure the heater panel doesn't overheat!
I've attached the backup.

Hmmm after consulting experts I've heard that there is no pin information in this binary as it is a non-standard device.

So guessing and multimeter is the only way.

Would you be able to sketch some connections? maybe in paint, on PCB photo?

is there a MCU under 7segment display?

Where are the button traces going?

There is an MCU under the display as feared. I'll pop the display off tonight and try and map out the traces.
Had a go at playing with the config but made no progress!

Does MCU connects to TXD1/RXD1 port of WiFi module, is this TuyaMCU?

Hello there,

'MCU' is TM1650 controller, connects CBU to SDA:P14, SCL:P16

Others:
Buzzer -> P8
Relay -> P20
Thermistor -> ADC

4 buttons:
KEY1 (on/off) -> TM.pin15
KEY2 (mode) -> TM.pin11
KEY3 -> TM.pin13
KEY4 -> TM.pin14

TM1650 ? Really? We just have added driver for TM1637 very recently.

Do you have that device at hand? Would you like to help us with testing/adding/changing the driver to fit that device?

EDIT: TM1650 chip can be bought on aliexpress, I will order it, but it's just chip, no display..

yeah, but 1650 communicates via i2c, while 1637 is SPI like if I'm not mistaken.
I've got the device here. I can measure what you want to know, but my programming skills are not the best..
In this device tm1650 is under a 2x7 segment led display, az shown on pictures above

I think both of those displays have communication protocol similar to I2C, but that's not 1:1 the I2C standard. We already have a software I2C code that works on any pins and we already have a 7 digits display frontend code. The frontend code should be shared, while backend should be per display model.

My TM1650 are on the way from China to me, but it will take some time for them to arrive. I will already try to do some tests. Please check this thread often, i will try to post some update for you to testing later today.

I am attaching TM1650 datasheet.

Btw, sadly the protocols while being similar, are not the same:

UPDATE: Can you update firmware and run:

command?
(yes, the TM1637 driver, don't change anything).

It assumes:

Quote:

'MCU' is TM1650 controller, connects CBU to SDA:P14, SCL:P16

Please test.

I updated to v1.15.580, entered the complete command, and.. nothing happened (neither in log) except on main page now shows: "1 driver active (TM1637), total 28" what pin settings should I use? SoftSDA/SCL, or TM1637DIO/CLK? (I tried both versions, with no luck)

EDIT:
I've found only one working lib for ESP8266, maybe it will help link

The test command already has your GPIO programmed, so there is no need to select them.

This schematic looks very nice, is it your work?

I don't think that this driver can help now. I just need to get that device myself. I have ordered.

I have pushed slight different version of communication , you can test if you want, but I would really need to have that device in front of me.
I really seem to think I follow the datasheet well:


Their approach seems very similar to mine...
https://github.com/zhuning239/TM1650/blob/master/main.ts

Hi there,

Any update with that TM ic?

My TM1650 arrived few days ago, I will try to look into it this week

Did anyone ever manage to crack this?

It's still pending, but we have now drivers for almost whole TM family so it should be easy:

Got the same device. Thought it's a normal, just flash and run device but ....
Is there an update on this?