LYWSD002MMC - TLSR8250 based!

[danergo]

Hi.

I found many articles only about the LYWSD002MMC. It was based on DA14585 from Dialog (Renesas).

But now I opened mine and it is now a new version (seems like), and this is based on the TLSR8250.

I wish to create a new firmware which prints the temperature onto the large display segments.

But I'm a little bit stucked: pins available are:

• GND
• VCC
• RESET
• SWS
• RX
• TX

Is it possible to flash this device via these pins? If so - what programmer is needed? (J-Segger?)

By any chance can I do OTA?

Any help would be much appreciated.

[pvvx]

Minimal programmer (Telink Swire emulator via USB-COM port) https://github.com/pvvx/TlsrComSwireWriter -> https://github.com/pvvx/TlsrComSwireWriter/blob/master/TLSR825xComFlasher.py

A programmer using a bootloader loaded via the Telink Swire interface, then running via UART https://github.com/pvvx/TlsrComProg825x

Normal programmer using Telink Swire hardware interface https://github.com/pvvx/TLSRPGM

First you need to read the entire Flash (512 kilobytes) and save it for recovery.

It is impossible to block programming (reading - writing) of the chip. If the programmer is working properly - then you can always restore the program. This chip does not have protection against reading and writing firmware.

[danergo]

Thanks.

Minimal programmer (Telink Swire emulator via USB-COM port) https://github.com/pvvx/TlsrComSwireWriter -> https://github.com/pvvx/TlsrComSwireWriter/blob/master/TLSR825xComFlasher.py

This is using only SWS and RESET pins on the board, and I need to connect those by your drawing, I assume, please correct me if I'm wrong. By default, these chips are open to receive (and send) firmware via Swire protocol?

One more thing: I need to send BLE Ads, and official Telink SDK doesn't seem to know this chip: https://wiki.telink-semi.cn/wiki/chip-series/TLSR825x-Series/

Do you have any idea where can we access the SDK for this TLSR8250?

[pvvx]

All Chips TLSR8250, 8251, 8253, 8258 have the same crystal and volume RAM = 64 kilobytes, and a built -in Flash crystal from 512 kilobytes. And only one of several versions of TLSR8258 one megabyte Flash. The difference between the TLSR825X chips lies in the chip body and what pins are made from the crystal. There is no more difference.

Use TLSR8258 settings with 512 KB Flash.

[danergo]

What is the correct reading command? The chip involved is TLSR8250F512ET32. It has internal 512K memory.

Command

./TLSR825xComFlasher.py -d -p /dev/ttyUSB0 rf 0 524288 default.flash
=======================================================
TLSR825x Flasher version 00.00.05
-------------------------------------------------------
Open /dev/ttyUSB0, 921600 baud...
Debug: default swdiv for 24 MHz = 52 (0x34)
Debug (read data):
000023: Debug (read data):
000024: Debug (read data):
000025: Debug (read data):
000026: Debug (read data):
000027: Debug (read data):
000028: Debug (read data):
000029: Debug (read data):
00002a: Debug (read data):
00002b: Debug (read data):
00002c: Debug (read data):
00002d: Debug (read data):
00002e: Debug (read data):
00002f: Debug (read data):
000030: Debug (read data):
000031: Debug (read data):
000032: Debug (read data):
000033: Debug (read data):
000034: Debug (read data):
000035: Debug (read data):
000036: Debug (read data):
000037: Debug (read data):
000038: Debug (read data):
000039: Debug (read data):
00003a: Debug (read data):
00003b: Debug (read data):
00003c: Debug (read data):
00003d: Debug (read data):
00003e: Debug (read data):
00003f: Debug (read data):
000040: Debug (read data):
000041: Debug (read data):
000042: Debug (read data):
000043: Debug (read data):
000044: Debug (read data):
000045: Debug (read data):
000046: Debug (read data):
000047: Debug (read data):
000048: Debug (read data):
000049: Debug (read data):
00004a: Debug (read data):
00004b: Debug (read data):
00004c: Debug (read data):
00004d: Debug (read data):
00004e: Debug (read data):
00004f: Debug (read data):
000050: Debug (read data):
000051: Debug (read data):
000052: Debug (read data):
000053: Debug (read data):
000054: Debug (read data):
000055: Debug (read data):
000056: Debug (read data):
000057: Debug (read data):
000058: Debug (read data):
000059: Debug (read data):
00005a: Debug (read data):
00005b: Debug (read data):
00005c: Debug (read data):
00005d: Debug (read data):
00005e: Debug (read data):
00005f: Debug (read data):
000060: Debug (read data):
000061: Debug (read data):
000062: Debug (read data):
000063: Debug (read data):
000064: Debug (read data):
000065: Debug (read data):
000066: Debug (read data):
000067: Debug (read data):
000068: Chip sleep? -> Use reset chip (RTS-RST): see option --tact

Chip pinout

Wiring

USB-Serial	TLSR8250
GND	GND
VCC (3.3V)	VCC
RX	Pin#5 (SWS)
RTS	Pin#25 (RESETB)

What am I doing wrong?

[pvvx]

https://github.com/pvvx/TlsrComSwireWriter ->

[danergo]

Okay, I added a 1K resistor and attached everything as your wiring (and VCC and GND):

$ ./TLSR825xComFlasher.py -d -p /dev/ttyUSB0 rf 0 524288 default.flash
=======================================================
TLSR825x Flasher version 00.00.05
-------------------------------------------------------
Open /dev/ttyUSB0, 921600 baud...
Debug: default swdiv for 24 MHz = 52 (0x34)
Debug (read data):
000023: fe 
Debug (read data):
000024: fe 
Debug (read data):
000025: fe 
Debug (read data):
000026: fe 
Debug (read data):
000027: fe 
Debug (read data):
000028: fe 
Debug (read data):
000029: fe 
Debug (read data):
00002a: fe 
Debug (read data):
00002b: fe 
Debug (read data):
00002c: fe 
Debug (read data):
00002d: fe 
Debug (read data):
00002e: fe 
Debug (read data):
00002f: fe 
Debug (read data):
000030: fe 
Debug (read data):
000031: fe 
Debug (read data):
000032: fe 
Debug (read data):
000033: fe 
Debug (read data):
000034: fe 
Debug (read data):
000035: fe 
Debug (read data):
000036: fe 
Debug (read data):
000037: fe 
Debug (read data):
000038: fe 
Debug (read data):
000039: fe 
Debug (read data):
00003a: fe 
Debug (read data):
00003b: fe 
Debug (read data):
00003c: fe 
Debug (read data):
00003d: fe 
Debug (read data):
00003e: fe 
Debug (read data):
00003f: fe 
Debug (read data):
000040: fe 
Debug (read data):
000041: fe 
Debug (read data):
000042: fe 
Debug (read data):
000043: fe 
Debug (read data):
000044: fe 
Debug (read data):
000045: fe 
Debug (read data):
000046: fe 
Debug (read data):
000047: fe 
Debug (read data):
000048: fe 
Debug (read data):
000049: fe 
Debug (read data):
00004a: fe 
Debug (read data):
00004b: fe 
Debug (read data):
00004c: fe 
Debug (read data):
00004d: fe 
Debug (read data):
00004e: fe 
Debug (read data):
00004f: fe 
Debug (read data):
000050: fe 
Debug (read data):
000051: fe 
Debug (read data):
000052: fe 
Debug (read data):
000053: fe 
Debug (read data):
000054: fe 
Debug (read data):
000055: fe 
Debug (read data):
000056: fe 
Debug (read data):
000057: fe 
Debug (read data):
000058: fe 
Debug (read data):
000059: fe 
Debug (read data):
00005a: fe 
Debug (read data):
00005b: fe 
Debug (read data):
00005c: fe 
Debug (read data):
00005d: fe 
Debug (read data):
00005e: fe 
Debug (read data):
00005f: fe 
Debug (read data):
000060: fe 
Debug (read data):
000061: fe 
Debug (read data):
000062: fe 
Debug (read data):
000063: fe 
Debug (read data):
000064: fe 
Debug (read data):
000065: fe 
Debug (read data):
000066: fe 
Debug (read data):
000067: fe 
Debug (read data):
000068: fe 
Chip sleep? -> Use reset chip (RTS-RST): see option --tact

[danergo]

Another test with "-t 2000":

$ ./TLSR825xComFlasher.py -d -t 2000 -p /dev/ttyUSB0 rf 0 524288 default.flash
=======================================================
TLSR825x Flasher version 00.00.05
-------------------------------------------------------
Open /dev/ttyUSB0, 921600 baud...
Reset module (RTS low)...
Activate (2000 ms)...
Debug: default swdiv for 24 MHz = 52 (0x34)
Debug (read data):
000023: fe fe fe 80 fe fe fe 80 80 
Debug (read data):
000024: 80 fe fe fe 80 80 80 80 80 
Debug (read data):
000025: fe 80 80 80 80 80 80 80 80 
Debug (read data):
000026: 80 80 80 80 80 80 fe 80 fe 
Debug (check data):
0ccc26: 80 fe fe 80 fe fe 80 80 fe fe 
bit mask: 0xc0
Debug (read data):
000027: 80 80 80 fe 80 fe 80 fe 80 
Debug (read data):
000028: fe 80 fe 80 fe 80 80 fe 80 
Debug (read data):
000029: 80 fe 80 80 fe 80 fe fe fe 
Debug (check data):
0ccc29: 80 fe fe 80 fe 80 fe fe 80 fe 
bit mask: 0xc0
Debug (read data):
00002a: 80 fe 80 fe fe fe fe fe fe 
Debug (check data):
0ccc2a: 80 fe fe 80 fe 80 fe 80 fe fe 
bit mask: 0xc0
Debug (read data):
00002b: fe fe fe fe fe fe fe fe fe 
Debug (check data):
0ccc2b: 80 fe fe 80 fe 80 fe 80 80 fe 
bit mask: 0xc0
Debug (read data):
00002c: fe fe fe fe fe fe fe fe fe 
Debug (check data):
0ccc2c: 80 fe fe 80 fe 80 80 fe fe fe 
bit mask: 0xc0
Debug (read data):
00002d: fe fe fe fe fe fe fe fe fe 
Debug (check data):
0ccc2d: 80 fe fe 80 fe 80 80 fe 80 fe 
bit mask: 0xc0
Debug (read data):
00002e: fe fe fe fe fe fe fe fe fe 
Debug (check data):
0ccc2e: 80 fe fe 80 fe 80 80 80 fe fe 
bit mask: 0xc0
Debug (read data):
00002f: fe fe fe fe fe fe fe fe fe 
Debug (check data):
0ccc2f: 80 fe fe 80 fe 80 80 80 80 fe 
bit mask: 0xc0
Debug (read data):
000030: fe 80 80 fe fe 80 fe fe fe 
Debug (check data):
0ccc30: 80 fe fe 80 80 fe fe fe fe fe 
bit mask: 0xc0
Debug (read data):
000031: 80 fe fe 80 fe fe fe 80 fe 
Debug (check data):
0ccc31: 80 fe fe 80 80 fe fe fe 80 fe 
bit mask: 0xc0
Debug (read data):
000032: fe 80 fe fe fe 80 fe fe fe 
Debug (check data):
0ccc32: 80 fe fe 80 80 fe fe 80 fe fe 
bit mask: 0xc0
Debug (read data):
000033: fe fe fe 80 fe fe fe fe fe 
Debug (check data):
0ccc33: 80 fe fe 80 80 fe fe 80 80 fe 
bit mask: 0xc0
Debug (read data):
000034: fe 80 fe fe fe fe fe fe fe 
Debug (check data):
0ccc34: 80 fe fe 80 80 fe 80 fe fe fe 
bit mask: 0xc0
Debug (read data):
000035: 80 fe fe fe fe fe fe fe fe 
Debug (check data):
0ccc35: 80 fe fe 80 80 fe 80 fe 80 fe 
bit mask: 0xc0
Debug (read data):
000036: fe fe fe fe fe fe fe fe e6 
Debug (read data):
000037: fe fe fe fe fe fe fe fe e6 
Debug (read data):
000038: fe fe fe fe fe fe fe fe e6 
Debug (read data):
000039: fe fe fe fe fe fe fe fe e6 
Debug (read data):
00003a: fe fe fe fe fe fe fe fe e6 
Debug (read data):
00003b: fe fe fe fe fe fe fe fe e6 
Debug (read data):
00003c: fe fe fe fe fe fe fe fe e6 
Debug (read data):
00003d: fe fe fe fe fe fe fe fe e6 
Debug (read data):
00003e: fe fe fe fe fe fe fe fe e6 
Debug (read data):
00003f: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000040: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000041: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000042: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000043: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000044: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000045: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000046: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000047: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000048: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000049: fe fe fe fe fe fe fe fe c6 
Debug (read data):
00004a: fe fe fe fe fe fe fe fe c6 
Debug (read data):
00004b: fe fe fe fe fe fe fe fe c6 
Debug (read data):
00004c: fe fe fe fe fe fe fe fe c6 
Debug (read data):
00004d: fe fe fe fe fe fe fe fe c6 
Debug (read data):
00004e: fe fe fe fe fe fe fe fe c6 
Debug (read data):
00004f: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000050: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000051: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000052: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000053: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000054: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000055: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000056: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000057: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000058: fe fe fe fe fe fe fe fe c6 
Debug (read data):
000059: fe fe fe fe fe fe fe fe c6 
Debug (read data):
00005a: fe fe fe fe fe fe fe fe c6 
Debug (read data):
00005b: fe fe fe fe fe fe fe fe 86 
Debug (read data):
00005c: fe fe fe fe fe fe fe fe 86 
Debug (read data):
00005d: fe fe fe fe fe fe fe fe 86 
Debug (read data):
00005e: fe fe fe fe fe fe fe fe 86 
Debug (read data):
00005f: fe fe fe fe fe fe fe fe 86 
Debug (read data):
000060: fe fe fe fe fe fe fe fe 86 
Debug (read data):
000061: fe fe fe fe fe fe fe fe 86 
Debug (read data):
000062: fe fe fe fe fe fe fe fe 86 
Debug (read data):
000063: fe fe fe fe fe fe fe fe 86 
Debug (read data):
000064: fe fe fe fe fe fe fe fe 86 
Debug (read data):
000065: fe fe fe fe fe fe fe fe 86 
Debug (read data):
000066: fe fe fe fe fe fe fe 86 00 
Debug (read data):
000067: fe fe fe fe fe fe fe 86 00 
Debug (read data):
000068: fe fe fe fe fe fe fe 86 00 
Chip sleep? -> Use reset chip (RTS-RST): see option --tact

[danergo]

And another with "-t 5000":

$ ./TLSR825xComFlasher.py -d -t 5000 -p /dev/ttyUSB0 rf 0 524288 default.flash
=======================================================
TLSR825x Flasher version 00.00.05
-------------------------------------------------------
Open /dev/ttyUSB0, 921600 baud...
Reset module (RTS low)...
Activate (5000 ms)...
Debug: default swdiv for 24 MHz = 52 (0x34)
Debug (read data):
000023: e6 1f fa df 10 fa 
Debug (read data):
000024: e6 1f fa 1f fa df 
Debug (read data):
000025: e6 1f f2 1f f2 90 
Debug (read data):
000026: e6 3f f4 3f 04 bf 
Debug (read data):
000027: e6 3f e4 3f 04 a0 
Debug (read data):
000028: e6 3f ec a0 bf ff 
Debug (read data):
000029: e6 3f ec 20 3f ec 
Debug (read data):
00002a: e6 3e c8 20 20 ff 
Debug (read data):
00002b: e6 7e d8 60 60 d8 
Debug (read data):
00002c: e6 7e 98 60 d8 7e 
Debug (read data):
00002d: e6 7e 90 60 90 60 
Debug (read data):
00002e: e6 7e b0 60 30 c8 fe 
Debug (read data):
00002f: e6 7e 30 40 30 18 e4 
Debug (read data):
000030: e6 7e 20 90 7e 3f fe 
Debug (read data):
000031: e6 fe 60 b0 fe 7f b0 
Debug (read data):
000032: e6 fe 60 20 fe 60 fe 
Debug (read data):
000033: e6 fe 40 60 fe 40 60 
Debug (read data):
000034: e6 fe c0 40 7f 60 fe ff 
Debug (read data):
000035: e6 fe c0 c0 ff 40 7f 60 
Debug (read data):
000036: e6 fe 80 c0 fe c0 c0 fe ff 
Debug (read data):
000037: e6 fe 80 80 fe 80 80 80 fe 
Debug (check data):
0ccc37: 80 fe fe 80 80 fe 80 80 80 fe 
bit mask: 0xc0
UART-SWS 92160 baud. SW-CLK ~25.3 MHz(?)
Outfile: default.flash
Read Flash from 0x000000 to 0x080000...
Read from 0x000100...
Debug: read swire byte:
00005c: 06 04 0c 0c 0c 0c 0c 0c c8 
Error Read Flash data at 0x000100! 

[danergo]

In case I manually skip 0x000100:

$ ./TLSR825xComFlasher.py -d -t 5000 -p /dev/ttyUSB0 rf 0x200 0x80000 default.flash
=======================================================
TLSR825x Flasher version 00.00.05
-------------------------------------------------------
Open /dev/ttyUSB0, 921600 baud...
Reset module (RTS low)...
Activate (5000 ms)...
Debug: default swdiv for 24 MHz = 52 (0x34)
Debug (read data):
000023: e6 1f fa df 10 fa 
Debug (read data):
000024: e6 1f fa 1f fa df 
Debug (read data):
000025: e6 1f f2 3f f6 b0 
Debug (read data):
000026: e6 3f f4 3f 04 bf 
Debug (read data):
000027: e6 3f e4 3f 04 a0 
Debug (read data):
000028: e6 3f ec a0 bf ff 
Debug (read data):
000029: e6 3f ec 20 3f ec 
Debug (read data):
00002a: e6 3e c8 20 20 ff 
Debug (read data):
00002b: e6 7e d8 60 60 d8 
Debug (read data):
00002c: e6 7e d8 60 d8 7e 
Debug (read data):
00002d: e6 7e 90 60 90 60 
Debug (read data):
00002e: e6 7e b0 60 30 c8 fe 
Debug (read data):
00002f: e6 7e 30 40 30 18 e4 
Debug (read data):
000030: e6 7e 20 90 7e 3f fe 
Debug (read data):
000031: e6 fe 60 30 fe 7f 30 
Debug (read data):
000032: e6 fe 60 20 fe 60 fe 
Debug (read data):
000033: e6 fe 40 60 fe 40 60 
Debug (read data):
000034: e6 fe c0 40 7f 60 fe ff 
Debug (read data):
000035: e6 fe c0 c0 ff 60 7f 60 
Debug (read data):
000036: e6 fe 80 80 fe c0 c0 fe fe 
Debug (check data):
0ccc36: 80 fe fe 80 80 fe 80 80 fe fe 
bit mask: 0xc0
Debug (read data):
000037: e6 fe 80 80 fe 80 80 80 fe 
Debug (check data):
0ccc37: 80 fe fe 80 80 fe 80 80 80 fe 
bit mask: 0xc0
UART-SWS 92160 baud. SW-CLK ~25.3 MHz(?)
Outfile: default.flash
Read Flash from 0x000200 to 0x080200...
Read from 0x000400...
Debug: read swire byte:
0000da: 06 04 0c 0c 0c 0c 0c 0c cc 
Error Read Flash data at 0x000400! 

I got error at 0x000400.

[danergo]

I used a 1K resistor between RX and TX as per your wiring.

[danergo]

This chip does not have protection against reading and writing firmware.

Are you sure?

Shot from TLSR8250F512ET32's datasheet:

[pvvx]

You have problems with your USB-COM adapter.

SWS is a Single Wire Slave. It works on the Telink SWire hardware protocol. It has nothing in common with UART. The Telink Swire protocol is emulated on Chinese USB-COM adapter chips:

• Does not work on FTDI chips.
• It does not work well if LEDs are soldered to the RX input of the USB-COM/UART adapter. You need to unsolder or cut out the LED.

The hardware version of the Telink SWire protocol, without emulation, is only possible on Telink chips.

Normal programmer using Telink Swire hardware interface https://github.com/pvvx/TLSRPGM

Programmer from Telink - Telink EVK: https://wiki.telink-semi.cn/wiki/IDE-and-Tools/Burning-and-Debugging-Tools-for-all-Series/

---

Are you sure?

This is just code encryption. It has nothing to do with reading the firmware.

[danergo]

CP2102 seems working (even with LEDs installed).

[danergo]

$ ./TLSR825xComFlasher.py -d -b 460800 -t 2000 -p /dev/ttyUSB0 rf 0x0 0x80000 default_1.flash
...
UART-SWS 46080 baud. SW-CLK ~25.3 MHz(?)
Outfile: default_1.flash
Read Flash from 0x000000 to 0x080000...
-------------------------------------------------------
Worked Time: 670.692 sec
Done!

$ ./TLSR825xComFlasher.py -d -b 460800 -t 2000 -p /dev/ttyUSB0 rf 0x0 0x80000 default_2.flash
$ diff default1.flash default2.flash
UART-SWS 46080 baud. SW-CLK ~25.3 MHz(?)
Outfile: default_2.flash
Read Flash from 0x000000 to 0x080000...
-------------------------------------------------------
Worked Time: 670.834 sec
Done!

$ diff -s default_1.flash default_2.flash
Files default_1.flash and default_2.flash are identical

Perfect. (Anyway, without -b 460800: 3 runs produced 3 different dumps, due to long wires. Once I switched to shorter wires, -b 460800 ruined the process, so I had to omit it => one might have to play with it!).

Now, for a very basic, simple hello-world example, which sdk would you suggest?

while(1) {
  gpioxy = 0x01; //turn PB<5> on (it's the "Reset" pad)
  delay(5000); //5s wait
  gpioxy = 0x00; //turn PB<5> off
  delay(5000);
}

Thank you!

[danergo]

Ok, managed to make:

• GPIOs working
• SWUART on SWS pin, to reuse the UART-USB for simple, one-way logging

Todo:

• Read temperature & humidity from SHT
• Read battery voltage
• Bluetooth LE ads
• Bluetooth OTA
• Reverse engineer the screen (hardest)
• Display data on the screen

[pvvx]

You need to:

1. Set the number for the LYWSD002MMC device in https://github.com/pvvx/ATC_MiThermometer/blob/master/src/app_config.h
2. Set the GPIO and sensor type
3. Set approximately the same type of screen controller.

Then load the resulting firmware and use the "60" function to create a map of screen segments. Rewrite some of the screen output functions.

[danergo]

Thx!

Will 60 work even when it's an epd with (most probably) spi controller?

[danergo]

Where shall I set device_type? in app_config I did, but app.c complains

[danergo]

okay, app.c and also app_att.c also have to be modified

[danergo]

my_HardStr, my_SerialStr needs to be adjusted in app_att.c. Where are those data coming from?

Besides of this, compiled, and flashing now. Bluetooth seems working, sensor seems working. Need to play more with gpios for the EPD.

17:04:33: Searching for devices 17:04:38: Connecting to: ATC_00048F 17:04:46: Hardware Revision String: 17:04:46: Software Revision String: V4.8 17:04:46: Firmware Revision String: github.com/pvvx 17:04:46: Detected custom Firmware 17:04:46: Hardware Version: Unknown or DIY (30) , Software Version: 4.8 17:04:46: Custom config HEX string: 55071000002804a931311e00

[danergo]

SPI_DO, SPI_CK seems matching, but how can I know which is EPD_BUSY, EPD_SHD, EPD_RST and EPD_CSB?

PA0, PA1, PB1, PC3 is connected to the FPC (among SPI_DO and SPI_CK). So I need to match PA0, PA1, PB1, PC3 to BUSY, SHD, RST, CSB. I have oscilloscope, but some guidance would be great to know what to check.

[pvvx]

All data from other thermometers was obtained using a logic analyzer. The original firmware was not decompiled, and there was no documentation for the EPD drivers. There were closely matching datasheets, and everything was selected by similarity and by examining protocol dumps.

[danergo]

OK, can you please help me with this?

Here are 8pins of the FPC with my logic analyser:

PA1 seems the SPI_CS? Although SPI_CK seems a bit odd at the beginning:

For PA0, maybe some kindof Enable?

[danergo]

Configured GPIO like below:

#define USE_EPD         (550/50 - 1) // min update time ms

#define EPD_RST             GPIO_PB1
#define PULL_WAKEUP_SRC_PB1 PM_PIN_PULLUP_1M
#define PB1_INPUT_ENABLE    1
#define PB1_DATA_OUT        1
#define PB1_OUTPUT_ENABLE   1
#define PB1_FUNC            AS_GPIO

#define EPD_SCL             GPIO_PD7
#define PULL_WAKEUP_SRC_PD7 PM_PIN_PULLDOWN_100K // PM_PIN_PULLUP_1M
#define PD7_INPUT_ENABLE    1
#define PD7_DATA_OUT        0
#define PD7_OUTPUT_ENABLE   1
#define PD7_FUNC            AS_GPIO

#define EPD_SDA             GPIO_PB7
#define PULL_WAKEUP_SRC_PB7 PM_PIN_PULLDOWN_100K // PM_PIN_PULLUP_1M
#define PB7_INPUT_ENABLE    1
#define PB7_DATA_OUT        1
#define PB7_OUTPUT_ENABLE   1
#define PB7_FUNC            AS_GPIO

#define EPD_CSB             GPIO_PA1
#define PULL_WAKEUP_SRC_PA1 PM_PIN_PULLUP_1M
#define PA1_INPUT_ENABLE    1
#define PA1_DATA_OUT        1
#define PA1_OUTPUT_ENABLE   1
#define PA1_FUNC            AS_GPIO

#define EPD_BUSY            GPIO_PA0
#define PULL_WAKEUP_SRC_PA0 PM_PIN_PULLUP_1M
#define PA0_INPUT_ENABLE    1
#define PA0_FUNC            AS_GPIO

/*
#define EPD_SHD             GPIO_PA1 // should be high
#define PULL_WAKEUP_SRC_PA1 PM_PIN_PULLUP_10K
*/

But screen doesn't change at all. Any suggestion?