logo elektroda
logo elektroda
X
logo elektroda

Reverse engineering of the unusual protocol of the Tuya FS-05R dimmer based on UART

p.kaczmarek2 6000 36
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
📢 Listen (AI):
  • #31 21488398
    @GUTEK@
    Level 31  
    I checked, running the tmSensor driver in addition does not change anything. What helps is adding at the end of the script that the command should be sent several times. Although this is not a very elegant solution.
    ...
    refresh:
    // channel 5 is temporary variable, from 0 to 255*3, multiplied also by toggle value
    setChannel 5 $CH2*3*$CH1
    // split into two bytes
    setChannel 3 $CH5/256
    setChannel 4 $CH5%256
    // send the two bytes
    tuyaMcu_sendCmd 0x30 00$CH3$$CH4$
    delay_ms 3
    tuyaMcu_sendCmd 0x30 00$CH3$$CH4$
    delay_ms 3
    tuyaMcu_sendCmd 0x30 00$CH3$$CH4$
    .
  • ADVERTISEMENT
  • #32 21640037
    jahara
    Level 4  
    Every few months the MCU stops controlling the dimmer and only power on/off works. The only way to get the dimmer to work is with a complete power cycle. Has anyone found a way to resolve this?
  • ADVERTISEMENT
  • #33 21703784
    jbornema
    Level 2  
    >>20986793
    Great work! I almost threw that device into trash, because Tuya firmware disconnected from cloud almost daily and I had to power-cycle. My device only need to send the commands twice (no clue why), and anything below dimmer value 65 was "off" for my LED, so I've added a min value. Here my autoexec.bat:

    
    // this is not really tuyaMCU but we will treat it as such
    startDriver TuyaMCU
    // set baud rate
    tuyaMcu_setBaudRate 115200
    
    // create a toggle and a dimmer
    setChannelType 1 toggle
    setChannelType 2 dimmer256
    
    // invoke refresh on change
    addEventHandler OnChannelChange 1 startScript autoexec.bat refresh
    addEventHandler OnChannelChange 2 startScript autoexec.bat refresh
    
    // restore states after reboot
    setStartValue 1 -1
    setStartValue 2 -1
    
    // min value
    setChannel 6 65
    
    refresh:
    if $CH2==0 then "setChannel 5 0" else "setChannel 5 ($CH6+($CH2-1)*(255-$CH6)/254)*3*$CH1"
    setChannel 3 $CH5/256
    setChannel 4 $CH5%256
    tuyaMcu_sendCmd 0x30 00$CH3$$CH4$
    tuyaMcu_sendCmd 0x30 00$CH3$$CH4$
    
  • ADVERTISEMENT
  • #34 21703814
    sp4rk1e
    Level 10  
    great work definitively. Somewhat naively I first tried to get the FS-05R running with Tasmota. With not much success. Searching for a solution I discovered 'OpenBK' and this thread. Tasmota does not provide an equivalent for 'tuyaMcu_sendCmd'. Basically this dimmer works with Tasmota:

    
    template:
    {"NAME":"FS-05R","GPIO":[0,2272,0,2304,0,0,0,0,0,0,0,0,0,0],"FLAG":0,"BASE":54}
    
    SetOption97 1                                                 # set 115200 bps
    SerialSend5 55AA0030000300000A3C      # dim to brightness 0x0a
    SerialSend5 55AA0030000300000032       # dim to brightness 0
    SerialSend5 55AA0030000300009DCF      # dim to brightness 0x9d
    


    For a productive solution in Tasmota you would have to resort to Berry :-(

    But in OpenBK I've got the same problem left as 'jbornema' and '@GUTEK@'. To be on the safe side I do have to issue the 'tuyaMcu_sendCmd' twice. Even without delay between the two is sufficient.

    jbornema wrote:
    tuyaMcu_sendCmd 0x30 00$CH3$$CH4$
    tuyaMcu_sendCmd 0x30 00$CH3$$CH4$


    Easily reproducible also on the console. About every other 6th 'tuyaMcu_sendCmd' is ignored by the device for some unknown reason...

    Any information that may help to find a solution is very welcome.
  • ADVERTISEMENT
  • #35 21710909
    sp4rk1e
    Level 10  
    the Tuya FS-05R dimmers are quite nice. They allow a decent control of dimming and even support 3 separate buttons. E.g. one for on/off, one for up, one for down

    attached a script currently supporting one button (as commonly used):

    features:
    - short press: switches on/off
    - double click: reverse dim direction (ping pong shortcut)
    - long press if device is on: dim either up or down
    - long press if device is off: turn on at brightness zero, continue from there with dim up
    - if brightness reaches the upper or lower bound: reverse dim direction (ping pong)
    - wifi LED reflects channel 1 state (on/off)

    
    startDriver TuyaMCU
    tuyaMcu_setBaudRate 115200
    tuyaMcu_defWiFiState 4
    PowerSave 1
    SetFlag 10 0                // Flag 10 - [MQTT] Broadcast self state on MQTT connect DONT CLUTTER LOG
    SetButtonTimes 2 3 2        // provides fast response and low lag
    SetChannel 14 40            // define dim stepsize
    
    // button o (connected in parallel to WiFi button)
    SetPinChannel 7 10
    SetPinRole 7 Btn
    // button -
    SetPinChannel 24 11
    SetPinRole 24 Btn
    // button +
    SetPinChannel 26 12
    SetPinRole 26 Btn
    // LED
    SetPinChannel 8 13
    SetPinRole 8 Rel
    
    alias reverse_dim_dir setChannel 14 -$CH14
    alias check_bounds if $CH2==1000||$CH2==0 then reverse_dim_dir
    alias turn_on_at_zero backlog SetChannel 1 1; SetChannel 2 1
    alias dim_step backlog if $CH2==1000||$CH2==0 then reverse_dim_dir; addChannel 2 $CH14 0 1000
    alias calc_sndcmd backlog setChannel 13 !$CH1; setChannel 5 $CH2*$CH1; setChannel 3 $CH5/256; setChannel 4 $CH5%256
    
    setChannelType 1 toggle
    setChannelType 2 dimmer
    addEventHandler OnChannelChange 1 startScript autoexec.bat refresh
    addEventHandler OnChannelChange 2 startScript autoexec.bat refresh
    addEventHandler OnClick    7 toggleChannel 1
    addEventHandler OnHold     7 if $CH1==0 then turn_on_at_zero else dim_step
    addEventHandler OnDblClick 7 reverse_dim_dir
    
    refresh:
    calc_sndcmd
    tuyaMcu_sendCmd 0x30 00$CH3$$CH4$
    tuyaMcu_sendCmd 0x30 00$CH3$$CH4$
    
  • #36 21716229
    p.kaczmarek2
    Moderator Smart Home
    This could be adjusted for new ping pong mode in addChannel
    Helpful post? Buy me a coffee.
  • #37 21716555
    sp4rk1e
    Level 10  
    p.kaczmarek2 wrote:
    could be adjusted

    now a version for the new firmware commands:
    
    // device: Tuya FS-05R
    //
    // features:
    // short press: switches on/off
    // long press if device is on: dim either up or down
    // long press if device is off: turn on at brightness zero, continue from there with dim up
    // if brightness reaches the upper or lower bound: reverse dim direction (ping pong)
    // after long press: reverse dim direction
    // wifi LED reflects state (on/off)
    
    startDriver TuyaMCU
    tuyaMcu_setBaudRate 115200
    tuyaMcu_defWiFiState 4
    PowerSave 1
    SetFlag 10 0                // Flag 10 - [MQTT] Broadcast self state on MQTT connect DONT CLUTTER LOG
    SetButtonTimes 2 3 2        // provides fast response and low lag
    SetChannel 14 40            // define dim stepsize
    
    // button o (connected in parallel to WiFi button)
    SetPinChannel 7 10
    SetPinRole 7 Btn
    // button -
    SetPinChannel 24 11
    SetPinRole 24 Btn
    // button +
    SetPinChannel 26 12
    SetPinRole 26 Btn
    // LED
    SetPinChannel 8 13
    SetPinRole 8 Rel
    
    alias turn_on_at_zero backlog SetChannel 8 1; SetChannel 9 1
    alias calc_sndcmd backlog setChannel 13 !$CH8; setChannel 5 $CH9*$CH8; setChannel 3 $CH5/256; setChannel 4 $CH5%256
    
    setChannelType 8 toggle     // arbitrary channel possible for this dimmer
    setChannelType 9 dimmer     // arbitrary channel possible for this dimmer
    addEventHandler OnChannelChange 8 startScript autoexec.bat refresh
    addEventHandler OnChannelChange 9 startScript autoexec.bat refresh
    
    addEventHandler OnClick   24 toggleChannel 8
    addEventHandler OnHold    24 if $CH8==0 then turn_on_at_zero else "addChannel 9 $CH14 0 1000 2" // with ping-pong
    addEventHandler OnRelease 24 addChannel 9 $CH14 0 1000 3        // indicate reverse direction to the firmware
    
    refresh:
    calc_sndcmd
    tuyaMcu_sendCmd 0x30 00$CH3$$CH4$  
    tuyaMcu_sendCmd 0x30 00$CH3$$CH4$    // cmd gets ignored often if sent only once
    
📢 Listen (AI):

Topic summary

The discussion focuses on reverse engineering the UART communication protocol of the Tuya FS-05R dimmer, which differs from typical TuyaMCU-based dimmers like the EDM-01AA-EU. The FS-05R uses a non-standard protocol between its WiFi module and the microcontroller responsible for dimming. Users successfully flashed the dimmer with OpenBK firmware and scripted it to work with Home Assistant, though some encountered issues with dimming smoothness and responsiveness. Problems included limited dimming range depending on the bulb type, delayed or inconsistent command responses, and the presence of a heartbeat signal (55 AA 00 00 00 00 FF) potentially interfering with communication. Solutions involved updating to the latest OpenBK firmware, adjusting baud rates, sending repeated commands to ensure reception, and disabling or working around the heartbeat. Some users replaced the original WiFi module with ESP-based boards and noted differences in baud rates and frame formats. The dimmer’s smooth transition effect is handled by the MCU, but slowing it further requires custom scripting. Compatibility varies with bulb types; not all bulbs are dimmable or suitable for this dimmer. The discussion also covers scripting techniques to map dimming ranges and attempts to integrate the device with ESPhome. Hardware variations and firmware batches affect behavior, and UART captures helped analyze the protocol. Overall, the thread provides detailed insights into the FS-05R’s unique UART protocol, firmware customization, and practical integration challenges and solutions for smart home automation.
Summary generated by the language model.
ADVERTISEMENT