Help with 4 pipe system

[Derek-K]

While I was shopping for a new thermostat, somehow I have come across this project. I have been programming ESP8266/32 interfacing with MQTT, so I am somewhat familiar with the process.

I have read the documentation here, but most of the model seems to be more or less for on/off relay. I need one that supports 4 Pipe (4P) system, in short, basically just 2 relays (1 for cold, 1 for hot) instead of 1.

I have spent hours and non of them really have a model number, just wondering if anyone comes across these and has any experience flashing them? https://www.aliexpress.us/item/2255801036966124.html?gatewayAdapt=glo2usa https://www.aliexpress.us/item/3256802449674199.html?gatewayAdapt=glo2usa

Both of them are "tuya" smart devices, but I have read some may not be using ESP MCU. Furthermore not sure if the existing firmware here is compatible with these devices.

Finally, correct me if I am wrong, looks like on most support devices, the ESP 8266 is more like a communication bridge between WiFi to another MCU (sometimes it's a PIC). But one will have to figure out the command string to send/receive from the MCU, is that correct?

[Derek-K]

Update: I ended up ordering the second one. It turns out it is using CB3S instead of ESP8266/32. On the other hand, it looks like the main controller is unmarked, and the WiFi module is just for communication. Even the NTC3950 sensor is not connected to the WiFi module.

From the datasheet https://developer.tuya.com/en/docs/iot/cb3s?id=Kai94mec0s076 only a few pins were used/soldered.

3 - CEN (enable pin) 8 - VCC 9 - GND 10 - P9 (GPIO) - 10k (R27) pull down to GND pin 15 - Rx - level shifted via Q1 16 - Tx - level shifted via Q8

Compare to ESP8266 (ESP12), the pin that's in use seems to be 100% compatible. If my understanding is correct (will try to find out) the WiFi module is just responsible for sending commands in serial via Tx and receiving data via Rx, it may be possible to transplant with an ESP12 module.

Update 2: CB3S module is using RF chip BK7231N. There is a project for building binaries https://github.com/openshwprojects/OpenBK7231N

[Derek-K]

Here are some sniffing results from the WiFi chip Tx pin to MCU. Looks almost identical to BAC-002.

The next task is to sniff Rx pin to see what's coming from the MCU...

But for now, looks like it may be possible to replace the WiFi chip with ESP12.

From WiFi chip TX

heartbeat (?):  55 AA 00 00 00 00 FF

Cool Mode: 55 AA 00 06 00 05 66 04 00 01 00 75
Heat Mode: 55 AA 00 06 00 05 66 04 00 01 01 76
Fan Mode : 55 AA 00 06 00 05 66 04 00 01 02 77

Eco on   : 55 AA 00 06 00 05 05 01 00 01 01 12
Eco off  : 55 AA 00 06 00 05 05 01 00 01 00 11

Lock     : 55 AA 00 06 00 05 06 01 00 01 01 13
Unlock   : 55 AA 00 06 00 05 06 01 00 01 00 12

Prog Mode: 55 AA 00 06 00 05 04 04 00 01 00 13 
Auto Mode: 55 AA 00 06 00 05 04 04 00 01 01 14

Fan Auto : 55 AA 00 06 00 05 67 04 00 01 00 76
Fan Hi   : 55 AA 00 06 00 05 67 04 00 01 01 77
Fan Med  : 55 AA 00 06 00 05 67 04 00 01 02 78
Fan Lo   : 55 AA 00 06 00 05 67 04 00 01 03 79

Set 35C  : 55 AA 00 06 00 08 02 02 00 04 00 00 00 46 5B 
Set 05C  : 55 AA 00 06 00 08 02 02 00 04 00 00 00 0A 1F
Set 20.5C: 55 AA 00 06 00 08 02 02 00 04 00 00 00 29 3E 
Set 21C  : 55 AA 00 06 00 08 02 02 00 04 00 00 00 2A 3F

Turn OFF : 55 AA 00 06 00 05 01 01 00 01 00 0D
Turn ON  : 55 AA 00 06 00 05 01 01 00 01 01 0E

Schedule: 

Workday #1 06:05AM 20'C
55 AA 00 06 00 3A 68 00 00 36 05 06 28 00 08 1E 1E 0B 1E 1E 0D 1E 00 11 
2C 00 16 1E 00 06 28 00 08 28 1E 0B 28 1E 0D 28 00 11 28 00 16 1E 00 06 
28 00 08 28 1E 0B 28 1E 0D 28 00 11 28 00 16 1E 15

Workday #1 06:00AM 20'C
55 AA 00 06 00 3A 68 00 00 36 00 06 28 00 08 1E 1E 0B 1E 1E 0D 1E 00 11 
2C 00 16 1E 00 06 28 00 08 28 1E 0B 28 1E 0D 28 00 11 28 00 16 1E 00 06 
28 00 08 28 1E 0B 28 1E 0D 28 00 11 28 00 16 1E 10

#breakdown
55 AA 00 06 00 3A 68 00 00 36 
#Weekday
00 06 28 #1 MM HH Temp*2
00 08 1E #2 MM HH Temp*2
1E 0B 1E 
1E 0D 1E 
00 11 2C
00 16 1E 
#Sat
00 06 28
00 08 28 
1E 0B 28 
1E 0D 28 
00 11 28 
00 16 1E 
#Sun
00 06 28 
00 08 28 
1E 0B 28 
1E 0D 28 
00 11 28 
00 16 1E 
#Checksum
10

[Derek-K]

Update. I have successful transplant the WiFi module with ESP12. However, I didn't tested with WThermostatBeca because the lack of GUI and I failed to get WebThings to work.

I switch over to Tasmota with some custom script and works fine. Tasmota already have TuyaMCU protocol supported.

But thanks for the work here inspired me for this hack.