This is a teardown and firmware change guide for Tongou DIN mounted MCB temperature and humidity with two 16A switching relay. Model TOVTH-216WTTDA. It has a BK7231N CB2S inside.
![[CB2S] How to Flash Custom Firmware on Tongou TOVTH-216WTTDA MCB with BK7231N CB2S?](https://obrazki.elektroda.pl/5278716300_1759656515.jpg "[CB2S] How to Flash Custom Firmware on Tongou TOVTH-216WTTDA MCB with BK7231N CB2S?")
Usage
The relays can be programmed on the MCU or remotely controlled via TUYA App based on temperature or humidity.
![[CB2S] How to Flash Custom Firmware on Tongou TOVTH-216WTTDA MCB with BK7231N CB2S?](https://obrazki.elektroda.pl/5525153500_1759656580.jpg "[CB2S] How to Flash Custom Firmware on Tongou TOVTH-216WTTDA MCB with BK7231N CB2S?")
![[CB2S] How to Flash Custom Firmware on Tongou TOVTH-216WTTDA MCB with BK7231N CB2S?](https://obrazki.elektroda.pl/7320933300_1759656579.jpg "[CB2S] How to Flash Custom Firmware on Tongou TOVTH-216WTTDA MCB with BK7231N CB2S?")
![[CB2S] How to Flash Custom Firmware on Tongou TOVTH-216WTTDA MCB with BK7231N CB2S?](https://obrazki.elektroda.pl/3634040500_1759656579.jpg "[CB2S] How to Flash Custom Firmware on Tongou TOVTH-216WTTDA MCB with BK7231N CB2S?")
Purchased from the Tongou store https://www.aliexpress.com/item/1005009707659555.html
![[CB2S] How to Flash Custom Firmware on Tongou TOVTH-216WTTDA MCB with BK7231N CB2S?](https://obrazki.elektroda.pl/6862853500_1759655949.png "[CB2S] How to Flash Custom Firmware on Tongou TOVTH-216WTTDA MCB with BK7231N CB2S?")
Opening
Like most MCBs, the rivets/ferrules must be drilled out on one side and pushed through
the faceplate is clipped in on the top and bottom, it will slide out with some gentle prying. The rest of the device will open after this
Inside
Which reveals the CB2S chip and a pair of relays quite tightly packed. There is limited space near the CB2S chip and difficult to get to the VCC, GND, TX, and RX which are on the back of the chip.
On the back side is the MCU. The RX and TX traces are again difficult to get to. The MCU's TX (which needs to be disconnected for flashing) isn't visible on the back, and is passed on a VIA hole underneath the MCU.
Disconnecting MCU and flashing
There are a few options to disconnect the MCU from the CB2S for flashing.
1. Lift the CB2S - Lifting the chip is usually my preferred method, but it's about 1.5mm space around the tuya chip and other components like the capacitor and relay. I abandoned this method as other components started melting
2. Lift the TX pin on the MCU. This would probably work fine, but because I can't see how close the TX VIA underneath the MCU is, I decided not to risk it.
3. the trace traverses underneath the relay, and the only decent opportunity is about 3mm past the relay. Still not a great option, but I did it with two of these without issue.
Gently scratch the circuit board to reveal the copper trace before the MCU TX VIA. Cut the trace 1mm before the VIA to leave yourself enough room to solder the cut later.
With the MCU disconnected, you can backup and flash the BK7231N as normal with OpenBeken.
OpenBeken config and tuyaMCU dpids
DPIDs were captured with the openbeken capture tools, as well as tuya developer json.
For simplicity, these are summarised in an autoexec.bat
// tuyaMCU store RAW data in /cm?cmnd=Dp
setflag 46 1
startDriver TuyaMCU
tuyaMcu_setBaudRate 115200
// always report paired (wifi symbol on screen)
tuyaMcu_defWiFiState 4
addEventHandler OnChannelChange 27 tuyaMcu_sendQueryState
// 2 switch 1 relay bool - 121 device control must be 2 or 3 (remote mode)
setChannelType 2 Toggle
setChannelLabel 2 "Switch 1"
linkTuyaMCUOutputToChannel 2 bool 2
// 7 cycle time str
// 20 Temp Unit Convert enum; 0 C, 1 F
// 27 current temperature /10
setChannelType 27 Temperature_div10
setChannelLabel 27 temperature
linkTuyaMCUOutputToChannel 27 val 27
// 28 current temperature F /10
// 30 Temp correction val; -9 - 9
// 46 current humidity
setChannelType 46 ReadOnly
setChannelLabel 46 humidity
linkTuyaMCUOutputToChannel 46 val 46
// 47 Humidity Calibration val -9 - 9
// 101 switch 2 relay bool - 121 device control must be 2 or 3 (remote mode)
setChannelType 3 Toggle
setChannelLabel 3 "Switch 2"
linkTuyaMCUOutputToChannel 101 bool 3
//102 online state enum; 0 online, 1 offline
setChannelType 1 TextField
setChannelLabel 1 "Online State"
linkTuyaMCUOutputToChannel 102 enum 1
// 103 probe/proximity switch bool
// 104 Switch 1 Automatic Mode bool
setChannelType 24 Toggle
setChannelLabel 24 "Switch 1 Auto Mode"
//linkTuyaMCUOutputToChannel 104 bool 24
// 105 Switch 2 Automatic Mode bool
setChannelType 25 Toggle
setChannelLabel 25 "Switch 2 Auto Mode"
//linkTuyaMCUOutputToChannel 105 bool 25
// 106 Power-On Relay Setting enum; 0 off, 1 on, 2 memory
setChannelType 6 TextField
setChannelLabel 6 "Power-on Settings"
linkTuyaMCUOutputToChannel 106 enum 6
// 107 Switch 1 Automatic Control Mode enum; 0 Temp, 1 Humidity
setChannelType 4 TextField
setChannelLabel 4 "Switch 1 Control Mode"
linkTuyaMCUOutputToChannel 107 enum 4
// 108 Switch 2 Automatic Control Mode enum; 0 Temp, 1 Humidity
setChannelType 5 TextField
setChannelLabel 5 "Switch 2 Control Mode"
linkTuyaMCUOutputToChannel 108 enum 5
// 21 Switch 1 Min Temp Set F val 14-212
// 22 Switch 1 Min Temp Set C val -10-99
setChannelType 22 TextField
setChannelLabel 22 "Switch 1 Min C"
linkTuyaMCUOutputToChannel 22 enum 22
// 41 Switch 1 Min Humidity Set val -10-99
// 109 Switch 1 Max Temp Set F val 14-212
setChannelType 9 TextField
setChannelLabel 9 "Switch 1 Min C"
linkTuyaMCUOutputToChannel 109 enum 9
// 110 Switch 1 Max Temp Set C val -10-99
setChannelType 10 TextField
setChannelLabel 10 "Switch 1 Max C"
linkTuyaMCUOutputToChannel 110 enum 10
// 111 Switch 1 Max Humidity Set val -10-99
// 112 Switch 2 Min Temp Set F val 14-212
// 113 Switch 2 Min Temp Set C val -10-99
setChannelType 13 TextField
setChannelLabel 13 "Switch 2 Min C"
linkTuyaMCUOutputToChannel 113 enum 13
// 114 Switch 2 Max Temp Set F val 14-212
// 115 Switch 2 Max Temp Set C val -10-99
setChannelType 15 TextField
setChannelLabel 15 "Switch 2 Max C"
linkTuyaMCUOutputToChannel 115 enum 15
// 116 Switch 2 Min Humidity Set C val 0-99
setChannelType 16 TextField
setChannelLabel 16 "Switch 2 Min Humidity"
linkTuyaMCUOutputToChannel 116 enum 16
// 117 Switch 2 Min Humidity Set val 0-99
// 118 event; 0 Normal, ... 9 Local Lock, 10 Local_mode, 11 Remote Mode, 12 Full control
setChannelType 18 ReadOnly
setChannelLabel 18 "Events"
linkTuyaMCUOutputToChannel 118 enum 18
// 119 switch 1 alarm settings raw
// 120 switch 2 alarm settings raw
// 121 device control mode enum; 0 local_lock (buttons locked), 1, Local_mode (MCU control), 2 Remote_mode (OBK control), 3 Full_control (MCU and Tuya control)
setChannelType 50 TextField
setChannelLabel 50 "Device Control"
linkTuyaMCUOutputToChannel 121 enum 50
tuyaMcu_sendQueryState
Some points to note:
1. the MCU controls the relays unless DPID 121 enum is set to 2 or 3. In these modes, openbeken can control the relays
2. the physical MCU programming is painful and documentation isn't especially clear.
3. programming the MCU via dpid's is equally painful, and isn't really a priority. I have some tuyaMCU captures that may be of use.
4. DPID 7 for cycling on-off patterns via the MCU is defined by a STR type, which I have experienced some difficulties performing with OpenBeken. I personally don't require this so I did not invest time into it... I control the relays from MQTT so I don't need the MCU doing this for me.
5. I think the tuyaMCU enums are best mapped in homeassistant, so I have only noted the mapping in the comments of the autoexec.bat
repackaging
As described in the Tongou MCB smart meter and relay teardown, you can either add new ferrules or use screws. I prefer the M2.5 x 10mm screws since they are easy and repeatable and don't require any special tooling.
