EQ3 firmwares 1.20+ not working anymore (requires pairing?)

[robluca]

After try to set target temperature at any values it goes at 5.0 Celsius Degree. With Fw 1.10 it is still working. I bought new one and I received it with new FW. Did you see similar issues? Thank you

[Ferrarista]

I honestly gave up with that problem, but I'm experiencing another issue with all the other devices I have at home. All of them are now on 1.46 firmware and coupled to the Calor BT app. Still every time I try to change the temperature from the app, I get a notification from my phone that I sould couple that device (I'm on Android). Then after few seconds, this message disappears and I can regularly control the device. It's just really annoying having to remove the coupling notification each single time.

[AleXSR700]

I can only recommend taking the plunge and setting up a Home Automation system like Home Assistant. So much more fun and better control of the eQ-3s.

[Ferrarista]

Could you elaborate? Thanks :)

[AleXSR700]

Well, you can control the eQ-3 from the Android app BTColor or whatever it was called. And if you have other devices like lamps or power sockets etc. you probably have one app per manufacturer.

An alternative is to set up e.g. Home Assistant (www.home-assistant.io) on a simple Raspberry Pi or any other mini computer and then control them all from there.

Essentially it is a software that allows control over all kinds of hardware, independent of manufacturer. You can then create all kinds of automation (turn on when home, turn off when away and whatever else you can think of. You are no longer limited to the apps features.

But you will need a Raspberry Pi or similar.

[Ferrarista]

Ok, that's quite some work that I might do in the future. In the meantime it would be nice to have at least the Calor BT app working :)

[AleXSR700]

Have not used it in a long time. Not even installed. I saw it was updated recently. And ratings remain very low with lots of connection issues.

So all I can think of is uninstall the app and re-install the latest and reregister all devices. Maybe it will help. Fingers crossed :)

[xrayer]

Hi, I got CC-RT-BLE-EQ device and installed calor BT 1.4.1 app to try. It worked fine until I tried to upgrade the BT FW. Upgrade process was finished without error but then I cannot pair with device anymore. The problem is when I press the rotary button for pairing that instead of pairing the display goes blank and it doesn't respond to any buttons like it was shutdown or in a deadlock. Only thing can be done is to remove and re-insert the batteries to restart it. It displays FW version 1.46 at power on and can be normally controlled by buttons but all attempts to pairing leads to hang. It doesn't advertise over BLE even BLE is on. The problem was already described on a German forum here - more users meet this bug and there's no solution, but I read it too late so be warned that you may brick your device! https://de.elv.com/forum/eqiva-bluetooth-n-kein-pairing-da-geraet-abschmiert-1.46-20210

Well as I'm naturally a bit curious I looked what's inside. Someone else before me already disassembled it and took nice photos: https://commons.wikimedia.org/wiki/Category:Disassembled_EQ-3_CC-RT-BLE-EQ There are 2 chips, one Cypress BLE RF SoC with ARM Cortex-M3, probably dedicated for BLE functions and second 8-bit low power MCU STM8L052 with LCD muxed controller that do all the rest. I guess that FW update affect only the BLE chip. I noticed that on the PCB there are 2 programming "connectors" (rather say testpoint arrays) PRG1 and PRG2. One I figured is connected to STM8 and use one wire SWIM debun interface (+ RST#, VBAT, GND) and the PRG2 is for BLE chips, I guess some kind of SWD but as the chip has not accessible any legs I cannot figure exact pinout, it has to be determined trial-error. I think there would be possible to reflash the chip. If someone else is curious too and has proper tools he could try to connect to PRG2 and try if the chip is unlocked and can be dumped. I also found that calot BT APK contains 2 binary blobs: \res\raw\bleupdate.bin and \res\raw\bleupdate_2.bin there are also BASE64? or so update.enc and update_2.enc versions probably the same content as *.bin This may be used to flash? But the size is only 19kB so it's not a complette image with BLE stack, it would be just some application only. Maybe the BLE chip has some bootloader that can upload the image. calor BT 1.2.1 contains some older FW than 1.3.6 and 1.4.1 that may work. Anybody else here tried to play with it at low level?

[xrayer]

Well, I found that the CYW20735 BLE chip doesn't have any flash memory, it just has some internal ROM with BLE stack and RAM. The BLE application have to be loaded in RAM on every power up. It can be done via SPI or I2C from external flash/eeprom. This device doesn't have any ext.memory so it's obvious that BLE FW resides in STM8 MCU internal flashrom. It would be possible to reprogram BLE app there but...

I connected to the STM8L052C6 via SWIM with ST-LINK V2 and STVP tool told me that there's read protection so we cannot dump the flash and patch the BLE app there :( The only possibility would be to write a new firmware from a scratch, it doesn't worth...

[dbuezas]

That's a pity, i wished there would some day be a way to get the measured temperature from the valve. Super interesting research by the way, 💪

[xrayer]

I have found a BLE debug/trace UART output at PRG2 con.pin 2, 115200 baud. There are a lot of interesting messages. I also found that my device can still advertise but due to bad FW update it happened that BLE on/off option on display menu got inverted. So when I set the BLE option to OFF it starts arvertising! And I can connect to it via nRF Connect from my phone. I tried to write 0xF0 byte for factory reset and it performed (same as if I trigger it from LCD menu) but it didn't fix anything. It seems like FW in STM8 MCU was not upgraded and new BLE FW behavior was changed and become incompatible together. If I could temporary connect BLE chip with some I2C EEPROM/SPI flashrom with old BLE FW version and boot it at power on then wiring it back to MCU pairing might work and then reflash it via old calor BT app (to get old BLE FW inside STM8 MCU)...

Here's the log of messages when I started pairing by push buttong and LCD goes blank, it's clear that something bad is happening - the unknown message indicates that new BLE FW doesn't understand old STM8 command (this repeats endlessly)...

Pack ADV Field perform Pack ADV Field perform

GPIO-Interrupt detected GPIO: TRUE INTERRUPT CALLBACK handler started! read data from UART fd Startsign detected read data from UART 91 Unknown MessageType INTERRUPT CALLBACK handler started! read data from UART 7e read data from UART 67 GPIO-Interrupt detected GPIO: FALSE GPIO-Interrupt detected GPIO: TRUE INTERRUPT CALLBACK handler started! read data from UART fd Startsign detected read data from UART 91 Unknown MessageType INTERRUPT CALLBACK handler started! read data from UART 7e read data from UART 67 GPIO-Interrupt detected GPIO: FALSE GPIO-Interrupt detected GPIO: TRUE INTERRUPT CALLBACK handler started! read data from UART fd Startsign detected read data from UART 91 Unknown MessageType INTERRUPT CALLBACK handler started! read data from UART 7e read data from UART 67