Exploring Tuya WT-SPI LED Controller With TuyaMCU: 1-4 Data Lines, 1000 LEDs, 8A, 5-24V Input, CBU

I have another device to play with!

This is Tuya SPI LED controller with up to 4 data lines (LED strip controller depending) supporting up to 1000 LEDs @ 8 amps. Its model is WT-SPI and a quick Google shows a few vendors for it.

https://www.aliexpress.com/item/1005005335498067.html



The product manual is quite good and is also available as a PDF, which I attach. The number of supported LED controller types seems quite extensive



I didn't know some LED types come with separate data and clock lines, which is why there is C01/D01 & C02/D02



Despite having a CBU/BK7231N module the device also comes with an MCU. The accepted input voltage is 5-24v with barrel or bare-wire connector options. With my 12V DC barrel adaptor the output is 12v, so natively good for LED strips that require 12v, like WS2811.




I think I have identified these components correctly



Along with their respective product pages:
https://www.xlsemi.com/datasheet/XL1509-EN.pdf
http://www.microne.com.cn/en/product/246.html
https://www.mcu.com.cn/en/Products/112
https://www.nexperia.com/products/analog-logi...ers/transceivers/series/74HC245-74HCT245.html

Because the MCU is connected to the CBU using RX and TX communication at 115200 baud, I was not able to take a dump of the CBU firmware without severing the TX trace to the MCU. Unfortunately I severed the RX too, I think I've usually only needed to do one before. No matter, it can be repaired.



And with the MCU out of the way I can take a backup, attached. Also, boot log:



Being v2.1.6 it is not patched and so Cloudcutter can be used to flash to Openbeken. My next steps are to repair the RX/TX and begin MCU communication capture using TuyaMCU Analyser. I have not been able to get a full API response from Tuya for this device so I'll have to use tuyaMcu_sendQueryState as explained here https://www.elektroda.com/rtvforum/topic4049908.html

I am curious to find out if the MOSI pin on the CBU is doing anything. Is the MCU doing everything and does it contain the full program of supported LED controller types and animation seen in the Tuya app? If so, can all these things be set by MCU command alone from within Openbeken? If so, it could mean a long autoexec and many GUI options to set in OBK. Sadly that would mean no OBK PixelAnim opportunities I fear.

ha. I guess I didn't look at the Cloudcutter profile hard enough. The dpIDs are listed, but not named.

hmm. and this is just the chip type selection


Added after 10 [hours] 3 [minutes]:

not sure I have the energy for getting every function mirrored in OBK, if that's even possible. The LED strip length calculation and free-style colour picker could be interesting to work out. :/

half the predefined animations:

The test pads on the PCB trace to these legs of the Cmsemicon 32-pin package BAT32G137GH32FP. I hoped they would include SWDIO and SWCLK so there's potential to dump the MCU flash using Jlink.



and I probably didn't need to cut the RX/TX on the underside as the reset pad pulled to ground could disable the MCU, freeing access to the CBU.

divadiow wrote:

and I probably didn't need to cut the RX/TX on the underside as the reset pad pulled to ground could disable the MCU, freeing access to the CBU.

maybe not. disabling the MCU with RESETB grounded means no CBU powering/booting

Added after 53 [minutes]:

with SWDIO and SWCLK connected to a J-Link SWD USB device and this custom device added to C:\Program Files\SEGGER\JLink_V796t\JLinkDevices.xml we can choose the correct MCU from the target device list. The FLM file for BAT32G137GH can be downloaded from https://www.mcu.com.cn/en/Products/112/pids/8



unzipped. file placed in C:\Program Files\SEGGER\JLink_V796t\JLinkDevices\Cmsemicon\BAT32G137GH.FLM





connected OK and entire chip read, seemingly successfully. 0x00000000 - 0x0001FFF. Attached.

Not sure what use this is, looks like gibberish. encrypted?

>>21147912

full dpID