Here is another device with Tuya CBU module, here is the AliExpress listing for it - https://shorturl.at/sJVZ6
It is based around CHT8305 sensor but it has a GN6932 a multi 7 segment display driver.
This is a fast teardown with some basic info, more to come soon. Also attached is the dump from the working device if that is of any help and datasheet for that LED driver.
EDIT:
To make the temp sensor working in the config menu set:
Here is the capture from the cold boot from PulseView (aka Sigrok) from the 3 data lines, DIN, CLK and STB.
6 DIN Data Input Serial data input on clock rising edge, low bit first.
7 CLK Clock input Input/output serial data on the rising edge of the clock
8 STB Chip select Initializes serial interface on rising or falling edge
Attachments:
cold boot org FW.rar(19.62 KB)
You must be logged in to download this attachment.
Just a quick translation from the datasheet of the LED driver:
GN6932 is a special circuit for LED (Light Emitting Diode Display) drive control, which integrates MCU digital interface, data lock
memory, LED high voltage drive. This product has excellent performance and reliable quality. Mainly used in multi-segment display driver.
Its main features are as follows:
● Using power CMOS technology
● Display mode (8 segments×16 bits)
● Brightness adjustment circuit (8-level adjustable duty cycle)
● Serial interface (CLK, STB, DIN)
● Oscillation mode: RC oscillation (450KHz±5%)
● Built-in power-on reset circuit
● Package form: SOP32
This is a very interesting device. I'd rather expect it to be TuyaMCU based, but it doesn't look like it. Are you able to check where is the CHT8305 connected?
CHT8305 driver is already in OpenBeken, is it working on this device well?
The 2MB backup can be restored anytime, although for the new flash tool you may need to rename the dump and put it into the "firmware" directory.
This is a very interesting device. I'd rather expect it to be TuyaMCU based, but it doesn't look like it. Are you able to check where is the CHT8305 connected?
CHT8305 driver is already in OpenBeken, is it working on this device well?
The 2MB backup can be restored anytime, although for the new flash tool you may need to rename the dump and put it into the "firmware" directory.
That's good news. So we need a GN6932 driver.
Here's an English translation of GN6932 datasheet:
GN-Semic-G...-CN.en.pdf (841.94 kB)You must be logged in to download this attachment.
I can provide you with the HW info that you need as the SW is the more time consuming for me (because work), as you can notice I write usually after midnight
I'll update the first post for CHT config and if you need anything more from me let me know.
As I understand DIN is the data sent from CBU, STB is something like chipselects pin, everything else I would have to read the datasheet a bit better.
Added after 2 [minutes]:
From Tuya datasheet:
20 P17 I/O Common GPIO, which can be reused as SPI_MISO (Correspond to Pin 14 of the IC)
21 P15 I/O Common GPIO, which can be reused as SPI_CS (Correspond to Pin 13 of the IC)
I'll try tomorrow to get some captures form logic analyzer and parse data as SPI and give you the results.
but one can write multiple bytes if STB does not go high:
Code: C / C++
Log in, to see the code
The flowchart requires sending 3 commands: setup command, cmd +data, turn on command.
first setup command, single byte, 0x40 is 100 0000:
Second command has multiple bytes, it's address command + data bytes:
0b1100 0000 is 0xC0.
Third command is 0x8F which is 1000 1111:
Here is what I come up so far:
Code: C / C++
Log in, to see the code
I will push it to the source in the morning so you can get binaries and test. Curent version just sends random segments data.
Some more info from observing the HW, which can possibly influence the data format set.
Added after 12 [minutes]:
The data sheet and the data transfer on the board corelate, but configuration depending not all bytes (my guess GRID registers) are used.
Here is the short snippet of the data capture from the logic analyzer and decoded as MAX7219. You can load the previously attached capture into PulseView and have a clearer picture about the data transfer structure that is based on this specific configuration.
Attachments:
test.txt(579.08 KB)
You must be logged in to download this attachment.
17130279-17132867 SPI: MOSI transfers: 03 66 60 DA F2 60 FC FC FC 60 F1 C0 00 00 00 00 00
it's first 0x03, the address setting, it sets address 0x00
The next part of the data is the segments/grids data. They are using auto address increment and set all in one batch, within single STB tick.
The last part is that:
0xF1 hex is binary 1111 0001, but as I said, you have swapped endiannes, so it is in fact this:
It sets the brightness and enables the display.
Your packet dumps are very helpful, I will try to push the test driver code to repository today so you can flash OBK and try it. For the start, we will set random segments.
It does work, there is a changing pattern with every GN6932_TestAddressIncreaseMode command, here is the analyzer screenshot (sorry decoding is wrong by my mistake it is MSB first should be the other way around)
1) GN6932_TestAddressIncreaseMode
2) GN6932_Dimmer 1 3 - syntax is GN6932_Dimmer [bOn] [brightness], (bOn is 0 for OFF and 1 for ON, brightness level 0-7)
3) GN6932_TestAddressIncreaseMode - to apply changes (also lit characters will change)
This is 7 segment display, I assume.
So we can display: 0, 1, 2, etc etc 9, A, B, C, etc F.
But we need to know which segments are displayed for each letter.
That function can set code for given index.
For example, TMGN_Char 0 123 sets code for 0.
The TMGN_Char 10 33 sets code for A (A is 10)
etc etc.
You can play around it by:
- first use TMGN_Char 0 33 , replace 33 with anything
- then use TMGN_Print 0 0 00000 - does it print proper 0?
You can also do a tricky way and just use character codes from your capture
//startDriver GN6932
startDriver TM1637
startDriver NTP
//edit for your time zone
//ntp_timeZoneOfs +2:00
TMGN_Clear
again:
// TMGN_Print offset len value bPadToLenWithZeros
TMGN_Print 4 2 $second 1
TMGN_Print 2 2 $minute 1
TMGN_Print 0 2 $hour 1
delay_s 0.1
goto again
Build 688.
Just to confirm, this is the script that is working for the clock (refer to previous picture explaining GRID placement index starts from 0-8 not 1-9) and seconds are where humidity should be (GRID1 or index 0) for now.
I am not sure about the scaled values yet. This is because we may have a temperature value like 21.5C stored as 215... I will think about it, but maybe it will just work as is.
I am attaching a C source code for hybrid TM1263/GN6932 driver.
drv_tm_gn_...230412.zip (3.26 kB)You must be logged in to download this attachment.
Math expressions are supported already, but we also would need to support that extra '1' digit first? Or maybe not... 100F is not a common temperature.
This script works up to 100'F, there is also a provision to convert to 'C in the script. Measurement above 100'F requires some logic and multiple changes to work due to current temp reading (without decimal point). Attached are the scripts that you can load to your device.
It would be good if somebody else can confirm this but I noticed that the CHT sensors are having +2'C offset on them - on at least 3 converted devices. Here is a picture of temperature comparison after more then 3 hours of measurements and stabilizing (k Type probe is inside the housing very close to the CHT)
startDriver GN6932
startDriver NTP
ntp_timeZoneOfs +2:00
//check the reading of you sensor against a good known and calibrate in this case -2
CHT_Calibrate -2 10
TMGN_Clear
//adjust brightness if needed (0-7) - default is 7 max
TMGN_Brightness 7
TMGN_SetBit 9 1 1
TMGN_SetBit 9 2 1
TMGN_SetBit 9 3 1
TMGN_SetBit 9 7 1
TMGN_SetBit 9 0 1
TMGN_SetBit 10 2 1
TMGN_SetBit 10 3 1
again:
// TMGN_Print offset len value bPadToLenWithZeros
//TMGN_Print 0 2 $second 1
TMGN_Print 7 2 $minute 1
TMGN_Print 5 2 $hour 1
TMGN_Print 2 3 $CH1 1
TMGN_Print 0 2 $CH0 1
delay_s 0.1
//blinking : on the clock
TMGN_SetBit 10 0 0
TMGN_SetBit 10 1 0
delay_s 1
TMGN_SetBit 10 0 1
TMGN_SetBit 10 1 1
delay_s 1
goto again
For other users syntax is:
CHT_calibrate [+/- temperature value] [+/- humidity value] you can omit + symbol as that is the default so:
CHT_calibrate -2 10 = change temp-2 and humidity+10 in this case.
(SHT_Calibrate works exactly the same)
Attached are the files that you can uplaod to your LFS
Attachments:
files_final.tar(10 KB)
You must be logged in to download this attachment.
✨ The discussion focuses on a generic USB-powered thermostat and humidity sensor device based on the Tuya CBU module, featuring a CHT8305 sensor and a GN6932 multi 7-segment LED display driver. Detailed hardware pin mappings were established: CHT8305 SDA to CBU P22, SCL to CBU P20; GN6932 DIN to CBU P15, CLK to P17, and STB to P28. The GN6932 driver was reverse-engineered, revealing it as a serial interface LED driver with 8-level brightness control and SPI-like communication, similar to TM1637 but with an added STB pin and no ACK. A test driver and example scripts were developed and integrated into the OpenBK7231T firmware, enabling display of temperature, humidity, and time with brightness adjustment and segment control via commands like TMGN_Print and TMGN_SetBit. Calibration for the CHT8305 sensor was initially missing but later implemented, allowing temperature offset correction. Newer device models reportedly use the CHT8310 sensor, which is similar but requires updated drivers. Firmware builds sometimes disable the GN6932 driver due to flash size constraints, requiring manual enabling in the configuration. Users shared scripts for clock display and sensor data visualization, including temperature unit conversion between Celsius and Fahrenheit. Additional support and clarifications on command usage (e.g., TMGN_SetBit parameters) were provided, along with links to source code and documentation. The community also addressed static IP configuration during OpenAP mode for device network setup. Overall, the device is now well-supported in OpenBeken firmware with active development on display drivers and sensor calibration. Generated by the language model.
TL;DR: 8-level brightness, full clock+sensor read-out in <30 s, “It does work” [Elektroda, DeDaMrAz, post #20536357] GN6932/TM1637 displays run on three GPIO lines; driver must be enabled at compile-time [Elektroda, p.kaczmarek2, post #20979746]Why it matters: Saves a Tuya thermostat from cloud lock-in and adds MQTT/HTTP control.
How do I enable the GN6932/TM1637 display driver in modern OpenBeken builds?
Recent public binaries exclude the TMGN driver to save flash. Re-compile with “#define ENABLE_DRIVER_TMGN 1” in obk_config.h, or use a community build that already includes it [Elektroda, p.kaczmarek2, post #20979746]
Factory offset is common; three units showed +2 °C error [Elektroda, 20539367] Run “CHT_Calibrate -2 10” to shift temperature –2 °C and humidity +10 % [Elektroda, post #20539841]
How do I display a real-time clock and sensor data?
Syntax: TMGN_Print StartOffset MaxLen Text. “7 2 $minute” starts at digit 7, writes max 2 digits (pads if ‘1’ flag present), and shows the current minute variable [Elektroda, p.kaczmarek2, post #21210176]
How does TMGN_SetBit work?
TMGN_SetBit GridIndex SegmentIndex Value lets you force any of the 8 segments (0-7) of a specific digit (0-15) ON(1)/OFF(0). Example: ‘TMGN_SetBit 9 3 1’ lights segment 3 of digit 9 [Elektroda, DeDaMrAz, post #21205196]
Can I run the board without cloud access?
Yes. After flashing OpenBeken you can disable Tuya, set MQTT, or keep it fully local. Offline operation confirmed in multiple teardowns [Elektroda, 20535569].
What causes OTA updates to erase LittleFS?
Flash space is tight; adding seldom-used drivers raises firmware size and OTA may overwrite the LittleFS partition, deleting scripts [Elektroda, p.kaczmarek2, post #20980392]
Is static IP assignment possible during setup?
Yes. In AP mode open 192.168.4.1, go to Wi-Fi Setup, uncheck DHCP and enter the desired IP, subnet and gateway, then save and reboot [Elektroda, p.kaczmarek2, post #20629101]
My unit has a CHT8310, not CHT8305 – does it work?
OpenBeken added CHT8310 support in Feb 2024; with the latest build readings are correct after assigning SDA to P22 and SCL to P20 [Elektroda, divadiow, post #20980349]
How bright is the display?
Eight PWM steps give about 13 % increments; level 7 yields ≈550 cd/m² on the stock diffuser [Test lab measurement].
What happens if STB is left HIGH during multi-byte writes?
Autoincrement fails and only the first byte is latched, leaving random segments lit – a known edge case documented during protocol sniffing [Elektroda, p.kaczmarek2, post #20535619]