Presentation, test, interior and communication analysis of the Tuya underfloor heating thermostat

.
I will present here a surface-mounted thermostat with LCD, external sensor and WiFi-based wireless control. The product shown here is compatible with the Tuya app and has a 5+2/6+1 programming function that allows you to set up to 6 different temperature settings for each day of the week and an additional setting for the weekend.
I will also include its communication analysis in the theme, which will allow me to change its firmware and upload OpenBeken so that it can be cloud free and connected to Home Assistant.

We bought the thermostat for £140. Let's start with the contents of the kit.
.
The unit, probe and instructions are included.
.
Images of the English-language manual:
.
.
It's rather pointless to rewrite and repost the instructions here, so we'll get straight to the post-pairing application presentation.

Pairing goes without a hitch - the device is based on the BK7231, so it is already detected over Bluetooth:
.
The device panel is quite complex. We have here mainly two modes of operation:
- automatic (according to a programme)
- manual (we set the temperature ourselves at a given moment)
We also have options such as child lock, which allows the touch panel of the appliance to be deactivated.
.
There is also an antifreeze option, which automatically starts heating when the temperature is far too low.
.
In the settings there is a choice of programme and probe - it can be external or internal.
.
Probe calibration is also available and there is even an option to control the backlight level.
.
The creation of the programme itself is quite simple. We select the periods and temperatures.
.
The rest of the options do not stand out - as we usually have the option of sharing a device, for example.

Now it's time for the more interesting bit....

Interior of the device .
The device is built like a typical WiFi controlled light switch. We remove the front panel.
.
You can already see some of the electronics, but here, however, there is an additional plastic component inside. More needs to be removed.
.
It appears that there is no LCD here after all. The screen is based on LEDs. The seller has provided information that is not true.
.
The main PCB is marked ME82H-WIFIMBLED-V1.3 The device is based on the WiFi WBR3 module , a chip from Realtek. In addition to the WiFi module, we also have an additional microcontroller which takes care of all the logic of the device, and a timer chip real DS1302Z with a quartz clock resonator and power supply backup for times of power loss. This allows the device to resume programming even if it loses power completely and WiFi is not available to retrieve time from the Internet with the NTP service.
.
The main MCU is the SOC SC92F8547P. It communicates with the WiFi module via the TuyaMCU protocol:
TuyaMCU protocol - communication between microcontroller and WiFi module .
This means that it will be useful to capture packets on the UART line right away. This will allow us to determine the dpIDs (identifiers) of the variables that determine the operation of the thermostat.

What remains is the board with the power supply and relays - ME86-DY-1.4.
.
The power supply in the device is implemented based on the LNK606DG.
.
The GMF2A is probably an inverter. Presumably the power supply gives 12V and something else has to generate 5V for the second board.
.
The presence of a large 12V relay (HF115F) confirms my suspicions. What we have here is a separate 12V power supply and separately some sort of step down converter. I don't think this 12V is going directly to the AMS1117-3.3V.
.
The board is quite well built. A varistor is present at the input to protect against surges, and there is also an anti-interference capacitor.
.


<br> UART communication analysis .
In this section I assume familiarity with TuyaMCU. I have described it here:
TuyaMCU protocol - communication between microcontroller and WiFi module .
For this, my tool for its analysis is still useful:
TuyaMCU Analyzer - UART packet decoder for Tuya devices - dpID detector .
Packet capture must be done in a secure manner. The device may have a mains potential on it, so you either need to supply it from a safe power supply (some devices of this type will work when run with a 24V DC power supply, for example) or use isolators such as ADUM1201. Otherwise we can short circuit the mains potential from the device to our USB to UART converter and damage the computer.

Here are the more interesting of the collected packages. Each one represents a different action performed by the applications.

Shutdown by phone:
.
The phone sends a change of state from dpID 1 to 0, type is boolean.

On:
.
Similarly, the state changes to 1.

Disabling child lock:
.
Child lock to dpID 40, bool type.

Setting the target temperature to 26.5:
.
dpID 16 is the temperature, sent as an integer type, multiplied by 10.

Change of sensor to external:
.
dpId 43 is an enumeration, a value of 1 indicates external.

Change the lower temperature limit to 12:
.
Same as with target temperature, value multiplied by 10.

Upper limit at 55:
.

Change difference start to 1:
.

Calibration to -7:
.
This is interesting, the calibration does not allow decimals.

Backlighting at 50%:
.
Curious, unknown packet type 0x20?


Change working day of the programme:
.


Change of mode to auto:


Further steps .
We have already gathered the information needed to change the firmware. There are now two further steps to follow, the first is to upload the new firmware via the UART. Instructions below:
WBR2, WBR3, WBRU, W701-VA2-CG pinout, datasheet, flashing for Home Assistant .
The second is the TuyaMCU configuration:
TuyaMCU flashing, installation and configuration guide - configure dpID for Home Assistant .
I will address this in a separate section.

Summary .
The product shown here is quite advanced, allowing manual or automatic control of the heating and also giving additional options such as calibration, child lock or there backlight level adjustment. The LED display seems quite clear to me, and I have no complaints about the touch functions either.
The internal design of the product is slightly better than usual. This time the manufacturer did not forget the varistor, the anti-interference capacitor is also present. The logic is based on TuyaMCU, which I have already discussed separately on the forum.
The WiFi module used inside is based on a Realtek chip, which is already supported by OpenBeken . It should be easy to change the firmware, which I will show in the next section.
Do you use this type of thermostat? Feel free to comment.