Avatto Tuya S16 PRO Wifi + RF Teardown and Internal Components Analysis

Question

This post is about smart IR+RF from AVATTO ( Aliexpress link) SPECIFICATION --Mode： S16 PRO --Product size: Ø65*21mm --Power input: DC 5V/1A (Micro USB2.0) --Infrared Frequency:38KHz --Infrared Range: ≤10Meters --Wi-Fi Protocol:2.4GHz --Wi-Fi Standard: IEEE 802.11 b/g/n --Operating Temperature...

p.kaczmarek2 · Answer

Thanks for sharing! SH-4 may be SHT40 I guess? I think we have driver for that, @divadiow may know more. I didn't test it myself. It was submitted by one of our contributors.

See ioRoles:
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/ioRoles.md
SHT3X_DAT and SHT3X_CLK maybe?

divadiow · Answer

I don't think the Tuya SH4 module is related to the Sensirion SHT40 temperature/humidity sensor.
https://developer.tuya.com/en/docs/iot/sh4-module-datasheet?id=Ka04qyuydvubw

I've not seen the SH4 module before, but I have seen this device on Ali Express wondering if it was worth buying for a look. I have no idea how the factory firmware interfaces with it or how OBK could either. It's a shame you didn't get the factory firmware. Also, I wonder what's under the RF shield on the SH4. I may have to get one now

Added after 7 [minutes]:

I have found this elsewhere though that contains an SH4 module and pin assignments stated by the user match the Avatto. Looks like the same device in a slightly different chassis. Backup attached.

Log in, to see the code

divadiow · Answer

@yarix2 did you happen to get the boot log or note the software version of factory firmware, if you paired to app?

I've just noticed SH4 is in here https://www.elektroda.com/rtvforum/topic3975921.html

the boot log for the firmware I posted (which may be different the one your device came with!) is

Log in, to see the code

where we see mention of the CMT2300A_notFound. So I guess that's what's under the RF shield

Added after 39 [minutes]:

https://www.elektroda.com/rtvforum/find.php?q...513%2C517%2C507%2C428%2C518&search_cat=43

yarix2 · Answer

I never logged in to Tuya or paired with original firmware. Thanks to you guys, I got used to buying a device and immediately flashing it :)Have a look at this repo it seems to add support in ESPHome.

divadiow · Answer

Cool. I see that mentioned on the other thread too. I wonder if it could be used in OBK. Maybe @olivluca can say.

yarix2 · Answer

Eventually, I was able to make the device work in ESPHome (sorry...). i have both IR and RF control 🥳
I had to use @olivluca component and the latest dev version of LibreTiny (as of writing this post, it's version 1.7.0) which contains a fix that @olivluca contributed there too.

Bottom line, there is open source solution to work with CBU and SH4 from Tuya! Now, it's just a matter of priorities and effort until it will show up in OpenBeken (and officially supported in ESPHome).

thank you all!

BTW - here are codes i used for my RF fan (it might help someone else here):


all-off:
Received Raw: 7813, -245, 750, -781, 249, -235, 765, -250, 784, -246, 750, -250, 781, -219, 816, -245, 757, -243, 821, -210, 749, -250, 781, -787, 213, -281, 749, -790, 210, -781, 250, -788, 211, -281, 750, -781, 218, -281, 781, -789, 211, -249, 781,-219, 781, -781, 249, -789, 211, -250, 781, -218, 781, -781, 250, -250, 781, -781, 218, -787, 244, -250, 750, -249

fan-on-off:
Received Raw: 7790, -269, 750, -780, 219, -250, 781, -251, 756, -273, 750, -249, 750, -281, 749, -250, 755, -276, 750, -250, 780, -250, 750, -789, 241, -250, 750, -781, 250, -781, 218, -785, 246, -250, 764, -766, 250, -250, 750, -788, 242, -812, 188,-281, 780, -781, 219, -753, 278, -218, 783, -779, 250, -749, 251, -780, 250, -218, 781, -250, 781, -250, 787, -774

light-on-off:
Received Raw: 7758, -278, 751, -782, 219, -250, 785, -247, 750, -282, 750, -251, 750, -282, 758, -242, 751, -281, 751, -250, 750, -282, 758, -774, 250, -250, 751, -782, 250, -761, 271, -750, 322, -179, 750, -782, 219, -301, 769, -775, 219, -250, 782,-782, 219, -218, 789, -275, 750, -219, 813, -219, 781, -219, 785, -779, 250, -782, 219, -281, 751, -250, 755, -277

Speed 1:
Received Raw: 7789, -247, 750, -783, 253, -215, 782, -281, 751, -218, 788, -277, 754, -246, 753, -278, 750, -251, 750, -281, 759, -242, 750, -782, 250, -250, 751, -783, 249, -781, 219, -782, 250, -250, 782, -750, 250, -251, 781, -751, 250, -782, 250,-250, 788, -213, 781, -251, 781, -219, 782, -250, 790, -773, 219, -782, 250, -219, 782, -785, 247, -782, 219, -253

Speed 2:
Received Raw: 7784, -249, 748, -781, 250, -250, 785, -215, 782, -250, 781, -219, 781, -277, 728, -245, 781, -250, 750, -250, 781, -282, 753, -747, 250, -250, 781, -750, 250, -814, 217, -750, 282, -218, 782, -750, 282, -218, 784, -778, 250, -782, 218,-250, 782, -222, 778, -781, 250, -250, 753, -778, 250, -253, 747, -250, 782, -250, 750, -281, 753, -247, 750, -282

Speed 6:
Received Raw: 7753, -278, 781, -755, 246, -250, 781, -219, 781, -250, 750, -250, 793, -238, 750, -250, 750, -281, 784, -216, 785, -247, 781, -781, 188, -281, 784, -751, 246, -782, 250, -796, 204, -250, 781, -782, 218, -250, 782, -781, 219, -250, 781,-784, 216, -781, 343, -157, 781, -250, 755, -778, 245, -255, 782, -750, 219, -782, 285, -747, 250, -751, 281, -219

1h:
Received Raw: 7808, -1792, 219, -250, 781, -250, 750, -250, 785, -247, 750, -250, 782, -250, 750, -250, 789, -242, 750, -250, 782, -781, 219, -250, 789, -774, 250, -750, 250, -781, 250, -219, 789, -774, 250, -219, 781, -781, 250, -253, 787, -242, 750,-250, 781, -782, 218, -254, 783, -245, 750, -816, 215, -782, 219, -784, 247, -781, 219, -782, 250, -781

2h:
Received Raw: 7754, -311, 755, -775, 218, -282, 750, -219, 781, -280, 756, -214, 782, -281, 750, -277, 723, -282, 750, -250, 750, -281, 751, -781, 219, -282, 749, -782, 218, -782, 250, -804, 211, -273, 743, -782, 250, -250, 781, -750, 250, -257, 775,-750, 250, -250, 750, -250, 782, -750, 281, -750, 250, -250, 782, -218, 782, -253, 778, -784, 216, -250, 782, -780
4h:
Received Raw: 7798, -234, 750, -782, 250, -250, 781, -250, 750, -250, 751, -281, 781, -219, 750, -282, 750, -250, 755, -276, 750, -250, 751, -781, 250, -250, 789, -742, 282, -750, 250, -781, 259, -210, 789, -774, 219, -250, 781, -781, 219, -795, 237,-781, 250, -219, 781, -320, 711, -787, 215, -792, 244, -247, 747, -782, 250, -786, 214, -781, 251, -250, 786, -245

ferbulous · Answer

@yarix2 do you mind sharing your full config? So rf receiver and transmitter works now?

yarix2 · Answer

>>21226777
sure - here is my ESPHome for that device:


external_components:
  - source:
      type: git
      url: https://github.com/olivluca/tuya_rf
      ref: master
    components: [ tuya_rf  ]

##
esphome:
  name: cbu
  friendly_name: cbu-wifi-rf

bk72xx:
  board: cbu
  framework:
    version: latest
   
wifi:
  ssid: !secret wifi_ssid
  password: !secret wifi_password
  
web_server:
  version: 3
  
#status led
output:
  platform: gpio
  id: status
  pin: P9

#reset button, it has an external pull-down in my board
binary_sensor:
  - platform: gpio
    id: reset_button
    pin: P23

#rf transmitter and receiver
tuya_rf:
  id: rf
  receiver_disabled: true
  dump: raw

  - pin:
      number: GPIO08
      inverted: true
      mode:
        input: true
        pullup: true
    tolerance: 55%
    dump: all
    id: ir_receiver
   
remote_transmitter:
  - id: ir_transmit
    pin: GPIO07
    carrier_duty_percent: 50%
   
## Example IR for A.C.
climate:
  - platform: climate_ir_lg
    name: "lg-ac"
    id: parents_ac_climate
    transmitter_id: ir_transmit
    receiver_id: ir_receiver

## some buttons for RF.   
button:
  - platform: template
    name: turn off receiver
    web_server_sorting_weight: 1010
    on_press:
       - tuya_rf.turn_off_receiver:
  - platform: template
    name: turn on receiver
    web_server_sorting_weight: 1020
    on_press:
       - tuya_rf.turn_on_receiver:
  - platform: template
    name: allOff
    web_server_sorting_weight:  10
    on_press:
       - output.turn_on: status
       - remote_transmitter.transmit_raw:
          transmitter_id: rf
          repeat:
            times: 7
            wait_time: 0s
          code: [7813, -245, 750, -781, 249, -235, 765, -250, 784, -246, 750, -250, 781, -219, 816, -245, 757, -243, 821, -210, 749, -250, 781, -787, 213, -281, 749, -790, 210, -781, 250, -788, 211, -281, 750, -781, 218, -281, 781, -789, 211, -249, 781,-219, 781, -781, 249, -789, 211, -250, 781, -218, 781, -781, 250, -250, 781, -781, 218, -787, 244, -250, 750, -249]
       - output.turn_off: status

olivluca · Answer

>>21226423 sorry for not replying earlier, I saw the alert just now.
Yes, as I said in the other thread I couldn't wrap my head around OpenBeken, and even under ESPHome the code is kinda ugly (I didn't feel like to rewrite all the SH4 code), but I think a developer knowing OpenBeken could use it to port the component.

divadiow · Answer

cool, thanks for responding. can you recall what about the OpenBeken setup you got stuck on? I'm probably not much help but others who may see this thread might chime in.

olivluca · Answer

>>21241174 it's not about the setup, but about the structure of the software and I'm too old and too lazy to study it

divadiow · Answer

lol. fair enough!

kingdomcitytaker · Answer

I see that the Avatto Tuya S16 pro comes with universal RF remote control.. I'm looking forward to using this device to control the gate using wifi.. I'm wondering whether this device supports ASK, FSK, PSK or all the above modulation? Apparently my gate remote is using rolling code modulation..
Can anyone share some insight about this device capability in the RF sector?
Many thanks in advance.. 🙏😊

olivluca · Answer

>>21495503
the cm2300A supports a bunch of modulations, the problem is you have to create a parameters file (.h) using the "cmostek rfpdk" configuration program (I don't remember where I got it), then send these parameters to the chip in your code.
Since I couldn't make heads or tails of the cmostek rfpdk(*) I simply captured on the i2c bus the parameters sent to the chip with the tuya firmware, which is the "right" configuration for 433MHz remotes. I found on github several projects that use a different configuration, e.g. to receive data from tire pressure sensors.
From the "cmostek rfpdk" tool I see that it supports OOK, FSK and GFSK modulation (whatever that means).

(*) actually I couldn't find a set of parameters that generated the same configuration I captured.

kingdomcitytaker · Answer

Thanks for the brief but rather intuitive insight.. so in a nutshell it is able to imitate & clone FSK signals...
That's all I need to hear...
I'm not tech savvy when it comes to injecting packets or mods.. hopefully it'll just work out of the box...
I got my fingers crossed 🤞

olivluca · Answer

>>21495643
I'm not sure if you want to use tuya firmware or my implementation for libretiny/esphome, but in any case it will only work if the modulation used is the same as a "normal" 433MHz remote.
Even then, if you use tuya firmware I highly doubt you can learn the remote if it's using rolling codes, but what do I know?
Even with my implementation the codes to be sent are fixed in the yaml, though I think that with some lamba magic you could generate codes on the fly.

kingdomcitytaker · Answer

I really have no idea what you are talking about.. since I'm not well versed in RF modulation & its jargons... Even to me.. ASK, FSK & PSK.. only means it has different kind of coding or frequency shifting modulation.. if you ask me.. unlike wifi.. which is pretty much defined & straightforward... 11-13 channels in the a/b/g/n 2.4 GHz bands.. & some other more channels in the 5 & 6 GHz bands.. each with its own security standards.. like WPS, WPA, PSK.. and such... I couldn't keep up as a general end user...

As for amateur radio band they also have the ASK, FSK, FMRS.. and other shits as well.. too advanced for my meager brain to keep up...
It's just simply too complicated for an average Joe..
But I appreciate your rather comprehensive explanation, since I'm just another John.. I'd simply ask if anyone has any success replicating/ cloning their autogate remote(s) with this device? Especially the ones notoriously more advanced security such as rolling modes remotes...as generally used in modern garage/ gate opener?

olivluca · Answer

>>21495678
Oh, I'm probably even less versed than you in RF, but my understanding is that the modulation is just a way to send bits over the air, so you not only have to match the modulation but also have to match the sequence of bits.
For a normal remote it's quite easy, since the bits for each key are always the same you can listen, learn them and then transmit them at will.
A rolling code remote will send a different set of bits each time you press the same key, so you have to know the algorithm and be able to generate the bits on the fly.
Again, this is just my understanding which could be totally wrong.

GPIO-CBU	Function	SH-4 pin	Comment
GPIO 07	IR - Tx transmitter		confirmed working
GPIO 08	IR - Rx receiver		confirmed working
GPIO 09	Status LED (blue led)		confirmed working

P6		CSB
P14		SCLK
P20		GPIO01
P22		GPIO02
P26		FCSB

Avatto Tuya S16 PRO Wifi + RF Teardown and Internal Components Analysis

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Didn't find an answer? Ask Artificial Intelligence

Topic summary