logo elektroda
logo elektroda
X
logo elektroda
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

Uploading OpenBK software to MOES BHT-002-GCLW v4 thermostat with TUYA CB3S BK7231N chip

tomik67 22971 133
Best answers

Can I flash the MOES BHT-002-GCLW v4 thermostat with OpenBK without damaging it, and what do I need to know first?

Yes — the device is based on TuyaMCU, and OpenBeken supports this class of BK7231N/TuyaMCU thermostats, but you must first identify and map the device’s dpIDs if you want the thermostat functions to work properly [#20744725] Before flashing, the UART connection to the MCU has to be broken; otherwise the firmware upload will not start [#20748515] The recommended approach is to capture TuyaMCU traffic on the original firmware, figure out which dpID controls which function, and then upload OBK and map those dpIDs to channels [#20744725][#20744898] In the thread, the user later confirmed the device was working with OBK after mapping dpIDs for on/off, eco mode, manual mode, temperatures, and relay state, and reported stable operation with Home Assistant [#20748861][#20874147]
Generated by the language model.
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
  • #121 21358437
    divadiow
    Level 38  
    Posts: 5108
    Help: 441
    Rate: 902
    Yes. Just the Tuya firmware backup. If you're worried your files might contain WiFi credentials feel free to send to me directly. I can reset/sanitise with test network credentials.
  • ADVERTISEMENT
  • #122 21359435
    tomik67
    Level 12  
    Posts: 111
    Rate: 11
    Can firmware-sized attachments be sent in a private message or are they too large ?
  • ADVERTISEMENT
  • #123 21360770
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14667
    Help: 656
    Rate: 12683
    Yes, why not? I've tested it. Attachments are working well on our forum. And we even have our own image hosting! Don't forget that.
    Screenshot of forum with attachment size test.
    Helpful post? Buy me a coffee.
  • #124 21361126
    divadiow
    Level 38  
    Posts: 5108
    Help: 441
    Rate: 902
    thank you for sending me the CB3S and WB3S Tuya firmware backup files

    Here's some info from them, might not be anything new. Your files attached but reset and only my test credentials might be in them.

    Tuya product name: 柏益温控器(采暖) (Baiyi Thermostat (Heating))


    CB3S

    Code: JSON
    Log in, to see the code


    Code: JSON
    Log in, to see the code
    Attachments:
    • CB3SreadResult_BK7231N_QIO_moes_3_2023-30-9-13-03-04.bin (2 MB) You must be logged in to download this attachment.
  • #125 21361148
    divadiow
    Level 38  
    Posts: 5108
    Help: 441
    Rate: 902
    WB3S

    Tuya product name: NH-HG-温控GBGCGA (NH-HG-Temperature Control GBGCGA)


    Code: JSON
    Log in, to see the code


    Code: JSON
    Log in, to see the code


    The only difference between the two sets is the name for dpID 101.
    Attachments:
    • WB3SreadResult_BK7231T_QIO_moes_10_2024-17-8-15-20-16.bin (2 MB) You must be logged in to download this attachment.
  • #126 21504599
    bl00dy
    Level 7  
    Posts: 38
    Rate: 3
    >>21141019 Hello, did you manage to install OBK?
  • ADVERTISEMENT
  • #127 21517128
    efenex
    Level 1  
    Posts: 1
    >>20744701

    Probably a stupid question, but here goes: when you say you soldered out the two components marked in red, does that mean you simply removed them completely or did you create the connection directly without the resistors (?) in between? I read in one of the later posts by someone else that you desoldered and bridged them, hence the confusion.

    Additionally, I understood that you ended up resoldering these - am I correct in assuming they need to be desoldered for the firmware flash, but once flashed they can (and should be) put back in place? And if they need to be put back, does it matter which side is which? The components are not marked so I honestly have no idea which side was where anymore.

    For some additional context: I have the same exact PCB/Layout as your original post, and am trying to replicate your success with OpenBK. My first step was attempting to dump the existing firmware. I've gotten to the point where I desoldered these components, since I didn't get any output before doing so. Afterwards, I am able to use both the hid_download_py tool and the BK7231GUIFlashTool (albeit with mono) to attempt to dump the original firmware. However, both tools have issues with reading the chip properly, hid_download_py explicitly gives CRC errors, and the backup in the GUI tool just gives failed. So at this point I wonder if it's my soldering, my toolset (running the above tools in an Ubuntu VM on an M1 MacBook...) or my understanding of what needs to happen. Any help would be appreciated: I have 5 of these and would like to get them all integrated with HA. Thanks in advance.
  • #128 21583365
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14667
    Help: 656
    Rate: 12683
    mvz0209 wrote:

    
    alias FaltHeartbeats backlog setChannel 0 1; addChannel 10 1; delay_s 2; setChannel 0 0
    addChangeHandler MissedHeartbeats > 4 FaltHeartbeats
    

    Please note that delay_s in backlog will work only in OBK builds later than 2025.06.19. It was not supported before. It should work now.
    Helpful post? Buy me a coffee.
  • #129 21584419
    bl00dy
    Level 7  
    Posts: 38
    Rate: 3
    I have several MOES thermostats with wb3s board. I use ESPHome, and find a big problem, which is not fixed already several years.
    tuya chip is going to be hot, as result i need to set my offset to +8 degree (default: +3, max: +9). And it's works this way. when device is off for several hour, then you turn it on, temperature shows OK. but in 15 minutes chip is hot. and even one device with some of firmware was so hot, as I can see in on LCD display.
    Another problem, device is hung once 2-3 days. the reason when I debug, send and receive data on a same time.
    as i can see a solution to fix, is not to send/receive on a same time, and have something like protection, next to not continuously receive data from tuya, but do it once 60 secs, for example. as for now it's every 1 second.
    in ESPhome I don't have this possibility.
    p.s. datapoint 104 is not functional, always return same value "ON".
  • #130 21584473
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14667
    Help: 656
    Rate: 12683
    If you want a custom feature, then I can write a driver for you, but that's obviously for OBK only. We have ability to run OBK on Windows with Simulator so it's very easy to do
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #131 21584588
    bl00dy
    Level 7  
    Posts: 38
    Rate: 3
    it's a tuya, not a driver i assume.
  • #132 21584726
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14667
    Help: 656
    Rate: 12683
    Try OBK powersave 1 for chip heating. By chip, you mean WiFi module?

    OBK has TuyaMCU queue option, and if not, we can try to use heartbeats missed event to reset it

    By dp 104 not functional, do you mean that it does not work in Tuya as well?
    Helpful post? Buy me a coffee.
  • #133 21585034
    bl00dy
    Level 7  
    Posts: 38
    Rate: 3
    >>21584726 dp 104 is always with status "ON", does not change, even when heating or not.
  • #134 21585036
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14667
    Help: 656
    Rate: 12683
    I do not know this particular device. Can you change dpID 104 from Tuya firmware?
    Helpful post? Buy me a coffee.

Topic summary

✨ The discussion centers on uploading OpenBK firmware to the MOES BHT-002-GCLW v4 thermostat, which contains a TUYA CB3S BK7231N WiFi module and a separate MCU managing the relay and sensors. Users confirmed that OpenBK supports TuyaMCU devices but requires knowledge of device-specific dpIDs to map variables correctly. The thermostat’s relay status is not exposed via dpID, necessitating hardware modification by wiring the relay coil voltage to a free GPIO pin for accurate relay state reporting. Communication occurs over UART at a non-standard baud rate (38400 or 34800), with some devices requiring desoldering or voltage level adjustments for proper flashing and MCU communication. The OpenBK autoexec.bat script is used to configure channels, map dpIDs, start drivers (TuyaMCU, NTP), and set WiFi state to paired (defWiFiState 4). Users integrated the thermostat with Home Assistant (HA) via MQTT, facing challenges such as inverted relay state reporting and temperature scaling (values divided by 2). Solutions include custom YAML configuration for HA, channel type adjustments (toggle_inv, read-only), and scripting for temperature setpoint commands with multiplication factors. The MCU occasionally freezes, requiring hardware resets; users implemented MCU reset via GPIO or power cycling using optocouplers or MOSFETs. A new OpenBK feature tracks missed heartbeats to trigger automatic MCU resets. Time synchronization via NTP is essential for correct thermostat operation, with suggestions to implement automatic daylight saving time adjustments. The community shared firmware backups, dpID lists, and scripts to improve stability and integration. Some users noted that original Tuya firmware is more stable, and freezing issues may stem from MCU firmware or hardware faults. Overall, OpenBK firmware provides stable operation and flexible integration with HA after proper configuration and occasional hardware modifications.
Generated by the language model.

FAQ

TL;DR: With dpIDs 1, 2, 3, 4, 5, 6, 101, and 102 identified and the UART path restored after flashing, this OpenBK workflow solves MOES BHT-002-GCLW v4 setup for Home Assistant users. One maintainer summed it up: "make a copy of the batch, upload OBK"—but only after packet capture and correct autoexec ordering. [#20768815]

Why it matters: This thread turns a risky BK7231N thermostat flash into a repeatable OpenBK, TuyaMCU, and Home Assistant integration path.

Variant Wi-Fi module Typical UART/Tuya notes Main risk from thread
BHT-002-GCLW v4 CB3S / BK7231N TuyaMCU over UART, usually 9600 baud Must break MCU-UART path for backup/flash
Earlier BHT-002 TYWE3S / ESP8266 Existing ESP thermostat projects exist Different firmware path
Some WHT/BHT revisions WB3S Some boards use 5 V MCU-UART levels May need voltage divider and different wiring

Key insight: OpenBK works on this thermostat when you treat it as a TuyaMCU device, not a direct-relay device. The flash itself is only half the job; dpID discovery, correct channel mapping, and script order determine whether controls work after reboot.

Quick Facts

  • The thermostat reported these working dpIDs in the thread: 1 power, 2 target temperature, 3 current temperature, 4 manual/program mode, 5 ECO, 6 button lock, 101 schedule raw, 102 floor or external temperature. [#20774147]
  • Temperature values are doubled: 10 = 5.0°C, 11 = 5.5°C, and the usable setpoint range shown was 5°C to 35°C in 0.5°C steps. [#20748861]
  • A working relay-state hardware mod used a free CB3S GPIO to sense about 3.25 V when the relay coil was energized and 0 V when off, because this thermostat does not expose real relay status by dpID. [#20761670]
  • The maintainer later added MissedHeartbeats handling; one tested reset rule triggered when missed heartbeats became greater than 4, then pulsed a reset channel for 2 seconds. [#21330239]
  • For one alternate thermostat board, TuyaMCU traffic was captured at 38400 baud on UART2, while the earlier CB3S/WB3S-backed BHT thread repeatedly referenced 9600 baud TuyaMCU communication. [#21253455]

How do I flash OpenBeken onto a MOES BHT-002-GCLW v4 thermostat with a TUYA CB3S BK7231N module without breaking TuyaMCU communication?

Yes—flash it as a TuyaMCU device, but restore the MCU-UART path afterward. 1. Back up the original CB3S firmware before writing OpenBK. 2. Temporarily break the MCU UART connection so BK7231 flashing tools can talk to the module cleanly. 3. After flashing, resolder the removed parts, boot OpenBK, start TuyaMCU, set tuyaMcu_defWiFiState 4, and verify dpIDs in the log. The thread showed OpenBK booting only after the removed components were soldered back, because TuyaMCU communication needed the original path restored. [#20748487]

What is TuyaMCU, and why do dpIDs matter when configuring a MOES BHT-002 thermostat with OpenBK or Tasmota?

"TuyaMCU" is a serial control protocol layer that lets a Wi-Fi module exchange typed data points with a separate thermostat MCU, using numbered dpIDs for each function. dpIDs matter because OpenBK and Tasmota cannot map power, temperature, ECO, or mode controls until each function’s dpID is known. The maintainer stated that without knowing which dpID matches which variable, you will not get started. On this thermostat, that meant capturing UART traffic before building the final OpenBK mapping. [#20744725]

Which dpIDs are used by the MOES BHT-002-GCLW thermostat for power, target temperature, current temperature, ECO mode, button lock, and manual/program mode?

The working map was: dpID 1 = power, 2 = target temperature, 3 = current temperature, 4 = manual/program mode, 5 = ECO mode, and 6 = button lock. The thread later confirmed 101 as the heating schedule raw block and 102 as external or floor temperature. For mode, the thermostat used dpID 4 enum, with 0 = programmable/auto and 1 = manual. These values were confirmed through captures, logs, and a final shared autoexec.bat. [#20874147]

What is the safest way to capture TuyaMCU UART packets on a MOES thermostat before flashing OpenBK?

The safest method is to capture packets while the thermostat still runs original firmware and is powered only from a safe low-voltage bench supply. 1. Resolder the UART path and pair the thermostat with the Tuya app. 2. Power the board from 3.3 V, or 5 V before the LDO, with mains disconnected. 3. Listen on the Wi-Fi module’s U1TX/U1RX during actions like setpoint changes or relay events, then decode the packets in TuyaMCUAnalyzer. That approach lets you identify dpIDs before flashing and avoids guessing. [#20744725]

Why do I need to disconnect or desolder the UART path to the MCU before backing up or flashing a CB3S/WB3S module?

You need to do it because the MCU shares the serial lines and interferes with the flashing session. The thread explicitly notes that firmware upload required the UART connection to the MCU to be broken first, and one user had to remove two nearby parts before BK7231 readout worked at all. After flashing, those parts were soldered back so TuyaMCU communication could resume. If you skip this, backup reads can fail with CRC or communication errors, and OpenBK may flash but not boot correctly with the thermostat logic. [#20748515]

Where should OpenBK TuyaMCU mapping commands be placed on this thermostat, and how do I build a working autoexec.bat file?

Place the TuyaMCU startup and channel mapping commands in autoexec.bat, not only in one-off command execution. A working file started NTP and TuyaMCU, set tuyaMcu_defWiFiState 4, declared channels 1 to 9, and linked dpIDs with linkTuyaMCUOutputToChannel, including 1 bool 1, 5 bool 2, 6 bool 3, 4 enum 4, 3 val 6, 2 val 7, 102 val 8, and 101 raw 9. That file became the stable baseline later shared for Home Assistant use. [#20874147]

Why did the ON/OFF command only start working properly after reboot when the channel mapping was moved before waitFor NTPState in autoexec.bat?

It started working because waitFor NTPState 1 delayed channel creation until after the MCU had already sent its initial state. When mapping came late, OpenBK missed the first dpID values, so the power channel was not initialized correctly after reboot. The maintainer identified this ordering bug and advised placing mapping first, or removing waitFor entirely. After that change, the user reported that ON/OFF and other functions worked immediately after reboot. [#20768969]

How can I map doubled temperature values on the MOES BHT-002 to OpenBK Temperature_div2 channels and Home Assistant MQTT topics correctly?

Map the thermostat’s value dpIDs to Temperature_div2 channels, then scale MQTT values in Home Assistant. In OpenBK, the working mapping was dpID 3 -> channel 6 for current temperature and dpID 2 -> channel 7 for target temperature. In Home Assistant YAML, the thread used current_temperature_template: '{{ float(value)*0.5|round(2) }}' and temperature_command_template: '{{ float(value)*2 }}'. That converts OpenBK channel traffic into real Celsius readings and sends the thermostat the doubled integer it expects. [#20874147]

What is Temperature_div2 in OpenBeken, and how does it convert the thermostat's doubled temperature values into real °C readings?

"Temperature_div2" is an OpenBeken channel type that stores a thermostat’s doubled integer temperature and presents it as a Celsius value divided by two, preserving 0.5°C steps. In this thread, 10 meant 5.0°C and 11 meant 5.5°C, so OpenBK needed a special type instead of a plain value channel. The maintainer added support after confirming this scale on the BHT thermostat, and later users showed it displaying correct temperatures in both the OpenBK GUI and Home Assistant. [#20748861]

How do I send time updates from OpenBK to a TuyaMCU thermostat and configure a custom NTP server for the MOES BHT-002?

Start the NTP driver, set your server, and let OpenBK feed time to the MCU. The working example used startDriver NTP, ntp_setServer 10.9.10.250, and ntp_timeZoneOfs +2:00. The thermostat’s MCU asked for time about hourly, and a user confirmed that a manually set clock reset after roughly 1 hour if no update arrived. The maintainer also noted that OpenBK can send time on demand from script, but regular NTP plus TuyaMCU time handling was enough for normal operation. [#20761117]

Why does Home Assistant Discovery show the relay state inverted or create a read-only temperature entity for this thermostat, and how can I fix it with manual YAML?

It happens because Discovery treats this thermostat’s relay-state and Temperature_div2 channels as generic entities, not a full climate model. One user saw the relay payloads reversed as `pl_on:
Generated by the language model.
ADVERTISEMENT