TOMTOP (Tuya) BAC-002-ELW Thermostat

Background

During the winter, the room temperature frequently drops below 15 ℃. I started to use the air conditioner but found that its controller is too old and its temperature control is very inaccurate, so I decided to replace it with a smart one and integrate it into HASS.

After disassembling the thermostat, I discovered that the plastic shaft of the knob had aged, causing the attached bimetallic disc to become loose, resulting in the failure of temperature control.

Based on the schematic diagram on the inner sticker, the wiring is straightforward and crude: one live wire goes in, and three wires go out to control heating, cooling, and fans respectively.

So I tested the wires with a multimeter and labeled them, I also measured the distance between the screw holes on the wall, which is about 60 mm, in line with the 86-type switch box standard.

After some research on the HASS forum and reddit, I found that most AC controllers compatible with HASS are infrared blasters, but the AC in my apartment doesn't have an IR receiver, thus I can only use a thermostat. However, most thermostats are for controlling hot water valves (to control heating only), very few of them support both heating and cooling. I looked around and finally found the tasmota-compatible BAC-002 series based on the Tuya ESP, so I bought one from AliExpress for €31.29 with free shipping.

The terminals on the back:

This thermostat was originally used for controlling 2-wire auto return ball valves. The hot and cold water valves each have two pairs of wires, for opening and closing respectively. For controlling my AC, I only need to turn on "open"; the fan controlling supports three levels of speed, I can choose any one of them to use

Since the smart thermostat needs power supply for itself but the original dumb thermostat didn't, so it didn't have a neutral line connected. But luckily there are still two wires came out from the wall that aren't used: a yellow-green ground wire, and another black wire, but unfortunately it was not connected to the main neutral. So I opened the ceiling partition where the internal AC unit is located, found the other end of the black wire and connected it to neutral.

That mysterious PCB wasn't connected to anything, maybe an unused power supply?

I connected the wires and checked that the thermostat can control the AC normally, both cooling and heating, I'm ready to flash tasmota firmware and de-cloud it.

Tuya says no

After disassembling, I directly soldered the required cables to the WiFi module, and started flashing tasmota through the web flasher, but it kept prompting that the device cannot be found, neither the chip information could be read using esptool.py. After wasting hours, I found in a GitHub issue that Tuya started promoting a new product line on a large scale from 2020 - a new WiFi IoT module that's compatible with the ESP modules both on physical specifications and the pins, but internally based on the Beken BK7231 series ARM SoC. Searching for the model number "WB3S" printed on this module, I confirmed that this module is one of them.

And such modules that do not use ESP chip can't be flashed with third-party firmware such as tasmota. Due to the lack of documentation, the research on the BK7231 series isn't advancing. [The most successful at present](https://www.elektroda.com/rtvforum/ topic3850712.html) only implemented some basic MQTT functions, and the development process looks very troublesome.

The official open-source SDK from Beken supports AliOS Things, it seems slightly easier, but I still don't want to go down that rabbit hole.

Anyway, if it's not an ESP, it has to be turned into one. Since the physical specifications and pins of the module are exactly the same as the ESP12 series, it can be ditched and replaced with a real one.

I should have used a hot air gun for desoldering, the consequence of using soldering iron and a utility knife is that several pads are accidentally pulled off:

Flashing

After removing the WiFi module, I started to reverse engineer the circuit. Back side of the PCB:

The largest IC in the upper right corner is a "YL1621" LCD display driver, and the one in the lower right corner is a "SC05B" is capacitive touch button driver.

The main function of the thermostat is realized by the "ME32S003K6T6" (ARM) MCU in the middle, and it communicates with the WiFi module by serial.

There is also an "ACE1117H" voltage regulator at the bottom right, after powering the thermostat, I found that there is +12 V on its Vin pin which comes from the connecter, it can be used as the power input during test.

Since I broke several solder pads, I had to find some places for jump wires.

Later I found ESPHome, good stuff, I abandoned tasmota straight after trying it out.

According to klausahrenberg/WThermostatBeca, the WiFi module and the MCU communicate using some protocol on serial. This type of MCU is called Tuya MCU in ESPHome.

I soldered the required Dupont cables, prepared a piece of ESP-12F flashed with ESPHome firmware and connected it to the controller (since the Vcc pad was also slightly damaged and fragile, the module uses an external power supply temporarily for testing), I was ready to start testing.

According to the parameters in WThermostat_BAC_002_ALW.h, the datapoint mapping of this thermostat is:

datapoint	type	data
1	switch	On/Off state
2	int	Target temperature
3	int	Current temperature
4	enum	Schedules mode
5	switch	- (ECO mode?)
6	switch	Child lock state
102	enum	HVAC mode (0: cooling, 1: heating, 2: ventilation)
103	enum	Fan mode (0: auto, 1: high, 2: medium, 3: low)
104	raw	Schedules

According to this, I set the parameters switch_datapoint, target_temperature_datapoint, current_temperature_datapoint required by ESPHome's Tuya Climate component; in addition, according to the temperature data coefficient is 2.0 (Tuya MCU communication protocol only supports integers, for example, a value 51 actually represents 25.5 ℃), I set temperature_multiplier to 0.5. Configuration example:

esphome:
  name: thermostat
  comment: 'Living room HVAC thermostat'

esp8266:
  board: esp12e

logger:
  level: WARN
  baud_rate: 0  # force disable serial logging to avoid occupying UART0

wifi:
  fast_connect: true
  networks:
    - ssid: !secret wifi_ssid
      bssid: !secret wifi_bssid
      password: !secret wifi_password

api:
ota:
  password: !secret ota_password

time:  # get time from HASS API
  - platform: homeassistant
    id: hass_time
    timezone: Europe/Madrid

uart:  # enable UART0 to communicate with Tuya MCU
  tx_pin: 1
  rx_pin: 3
  baud_rate: 9600

tuya:
  time_id: hass_time  # provide HASS time to Tuya MCU

climate:
  - platform: tuya
    id: hvac
    name: 'HVAC'
    supports_heat: true
    supports_cool: true
    switch_datapoint: 1
    target_temperature_datapoint: 2
    current_temperature_datapoint: 3
    temperature_multiplier: 0.5
    visual:
      min_temperature: 5.0
      max_temperature: 35.0
      temperature_step: 0.5

After powering on the controller, the ESPHome logs successfully dumped the Tuya MCU communication:

HASS will then notify that a new ESPHome device has been discovered. After adding it, I could directly add a thermostat card to lovelace:

After testing that all the functions were working ok, I flashed the firmware to a bare ESP-12F and soldered it onto the controller, with some jump wires to several pins located on the damaged pads. To make it easier, I directly solder a pull-down resistor on the module for GPIO15. The completed modification: