FAQ
TL;DR: TLC2326 firmware 2.1.17 is patched; "can't be exploited with tuya-cloudcutter." Use ESPHome via UART or desolder-flash. For BK7231N/Tuya CBU owners of EPT Tech TLC2206/TLC2326 who want local control without Tuya cloud. [Elektroda, john34, post #21206092]
Quick Facts
- UART between BK7231N and TuyaMCU runs at 9600 baud (baud_cfg: 9600). [Elektroda, divadiow, post #21135841]
- Datapoints: DP1 state enum; DP2 depth (scale 0.01 m); DP7/8 alarm %; DP19 height 0.200–2.500 m; DP21 distance 0.100–2.400 m; DP22 level 0–100% (RO). [Elektroda, divadiow, post #21135841]
- TLC2206 now has a Cloudcutter profile; successful flash confirmed. [Elektroda, john34, post #21191171]
- TLC2326 on firmware 2.1.17 requires desoldering the Tuya MCU and flashing with ltchiptool, then resoldering. [Elektroda, john34, post #21206092]
- ESPHome has a bug for setting height/alarms; an external component workaround works and "Works nicely so far." [Elektroda, piotrszulc1, post #21139441]
Which SoC and module are inside the EPT Tech TLC2206/TLC2326?
They use a Tuya CBU-IPEX module with a BK7231N SoC. The main board is covered in epoxy potting. The original poster confirmed the module and shared photos of the potted board and antenna layout. This hardware choice enables Wi‑Fi and BLE and connects to a secondary MCU over UART. [Elektroda, john34, post #21083458]
Is it a TuyaMCU device, and why won’t a simple flash work?
Yes. A TuyaMCU device pairs a Wi‑Fi module with a separate MCU over UART, so firmware alone is not enough. You must configure datapoint IDs and behavior after flashing for the device to function. "It wont work if you just flash a new firmware." [Elektroda, p.kaczmarek2, post #21083504]
How do I flash the TLC2206 using tuya-cloudcutter?
- Update Cloudcutter and select the TLC2206 profile.
- Put the device in pairing mode and run the exploit.
- Flash your LibreTiny/ESPHome image and reboot.
A user confirmed success and noted, "Works nicely so far." Use ESPHome afterward to map the Tuya datapoints. [Elektroda, piotrszulc1, post #21139441]
Cloudcutter says not exploitable — what about the TLC2326?
TLC2326 units with firmware 2.1.17 are patched and cannot be exploited. The working path was to hot‑air remove the Tuya module, flash with ltchiptool, then resolder. The user reported it "can't be exploited with tuya-cloudcutter." Plan on careful rework and verification afterward. [Elektroda, john34, post #21206092]
How do I safely remove potting and the Tuya module to flash?
- Use hot air to soften the potting.
- Pierce with tweezers and lift off potting in chunks.
- Desolder the Tuya module, flash via ltchiptool, then resolder it to the PCB.
This approach resolved flashing interference from the attached MCU and restored full function after reassembly. [Elektroda, john34, post #21206092]
What UART settings and pins should I use with ESPHome on BK7231N/CBU?
Use bk72xx: board cbu with LibreTiny. Configure UART on RX1/TX1 at 9600 baud. This matched the working configuration for TLC2206, enabling stable TuyaMCU communication. You can also expose text and number entities tied to datapoints for status and calibration. [Elektroda, piotrszulc1, post #21192328]
Which Tuya datapoints map to level, depth, and alarms?
DP1: state enum (normal/lower_alarm/upper_alarm). DP2: depth value with scale 0.01 m. DP7 and DP8: alarm thresholds in percent. DP19: installation height 0.200–2.500 m (scale 0.001). DP21: distance to max 0.100–2.400 m (scale 0.001). DP22: level 0–100% read‑only. [Elektroda, divadiow, post #21135841]
Why can’t I set installation height or alarm thresholds in ESPHome?
There’s a known ESPHome issue blocking those setters on this device. A user succeeded by using an external component that handles the required datapoints. "You can use it in esphome, but currently it is not possible to set the height or alarm levels." [Elektroda, piotrszulc1, post #21139441]
DP22 stopped updating after hours — how do I fix it?
One report saw DP22 freeze while DP1 and DP2 continued updating. Switch to an external TuyaMCU component, or derive level from DP2 until stable. If using the native Tuya component, try shorter update intervals or a watchdog restart. Validate serial timings and wiring. [Elektroda, john34, post #21193336]
My level reading stalls around 50%. How can I improve accuracy?
Recheck installation height (DP19) and distance-to-max (DP21), then recalibrate. Smooth readings by averaging, and confirm sensor alignment. A user noted readings "rarely" dropped below 50% and added, "So there definitely is a problem with settings..." Re‑tuning those numbers typically restores expected behavior. [Elektroda, piotrszulc1, post #21192328]
Why is the PCB potted/coated and how should I approach it?
The coating protects the PCB from moisture. If you must access pads or remove parts, warm the potting and lift gently to avoid damage. "It’s used to secure the PCB against the moisture." Work slowly to prevent pad lifting during rework. [Elektroda, p.kaczmarek2, post #21086033]
Can I use OpenBK (OBK) instead of ESPHome to handle TuyaMCU?
Yes. OBK supports TuyaMCU with configurable datapoints and has a detailed setup guide. After flashing, map dpIDs to Home Assistant entities to restore full functionality. The author offered step‑by‑step help to set it up correctly. [Elektroda, p.kaczmarek2, post #21083504]
What entities make sense to expose in Home Assistant?
Expose Liquid Level (%) from DP22 and Liquid Depth (m) from DP2. Add a text sensor for Liquid state (DP1). Create number entities for min/max alarms (DP7/DP8), installation height (DP19), and distance to max (DP21). This mirrors a proven working config. [Elektroda, piotrszulc1, post #21192328]
I see "Initialization failed at init_state" on boot. Is that fatal?
A TLC2326 user reported the Tuya component shows that error at boot, yet data still flows correctly. Treat it as a benign startup quirk if measurements look correct. Monitor logs and only intervene if datapoints stop updating or controls fail. [Elektroda, john34, post #21206092]