How does CB3S UART module communicate with CMS32L051 MCU in Noname Reclosing Protector?

Hello. Could you please provide some information regarding my question?
I have an Automatic Reclosing Protector.
Disassembled the device and found the following components:
TM1621B - screen controller
CMS32L051 - microcontroller that controls everything
24C64 - EEPROM
CB3S - (not pictured) - I assume it's a UART bridge between the CMS32L051 and the Wifi/TUYA server. CB3S connected to mainboard only /-/rx/tx

My question is: can someone explain how the communication between the CB3S and the CMS works? I tried all the port speeds, but didn't see any meaningful information. I only see zeros, but the number of zeros can vary depending on load manipulation and button presses.

Sincerely, xopek.

This is usually done via TuyaMCU.

Protocol background:
https://www.elektroda.com/rtvforum/topic3880546.html

Analyzer tool:
https://www.elektroda.com/rtvforum/topic3970199.html

Setup guide:
https://www.elektroda.com/rtvforum/topic4038151.html

How do you probe that protocol? Do you know that connecting a main powered device to PC is very dangerous, the power supplies there are not isolated and there may be mains potential on UART lines? That being said, I also observed that you need to power whole device to get communication. Maybe try powering it from 24V DC on 230V input and see if it manages to start, but only if you understand what you're doing.

Or skip packet capture , just do 2mb flash backup, flash obk, and try to go from there, but that may pose some other problems...

>>21742115
I'm aware of the danger. Thank you for your concern.
Thanks for the links. I've read them. I think I searched the forum and googled them, but I couldn't find anything similar myself.
Now I'll dump the data and flash the OBK.
In the analysis log, I haven't seen anything about voltage, current, or status yet, but I think after switching to the OBK, it will become a little clearer and more convenient.

There is no separate dpID for current/voltage/etc. They are using compound format, raw bytes array, usually VCP, 2 bytes per voltage, scaled by 10, so precision to single decimal point.
Search for: DP_TYPE_RAW_TAC2121C_VCP
https://www.elektroda.com/rtvforum/find.php?q=DP_TYPE_RAW_TAC2121C_VCP
On your capture, dpID 6 looks interesting. The first bytes are 091C, which can be decoded into 2332 decimal:

The following is most likely your voltage value. Next bytes are 0, so I'd guess that they are current and power, just like in DP_TYPE_RAW_TAC2121C_VCP.

This format is known and works in OBK well. That being said, if you have some format that is not yet in OBK, then it's also not a problem - we're here to help, we can add a support for a new format for you.