TOMTOP (Tuya) BAC-002-ELW Thermostat

Background

During the winter, the room temperature frequently drops below 15 ℃. I started to use the air conditioner but found that its controller is too old and its temperature control is very inaccurate, so I decided to replace it with a smart one and integrate it to Home Assistant.

After disassembling the thermostat, I discovered that the plastic shaft of the knob has aged, causing the attached bimetallic disc to become loose, resulting in the failure of temperature control.

Based on the schematic diagram on the inner sticker, the wiring is straightforward and crude: one live wire goes in, and three wires go out to control heating, cooling, and fans respectively.

So I tested the wires with a multimeter and labeled them. I also measured the distance between the screw holes on the wall, which is about 60 mm, in line with the 86-type switch box standard.

After some research on the Home Assistant forum and reddit, I found that most AC controllers compatible with Home Assistant are infrared blasters, but the AC in my apartment doesn't have an IR receiver, thus I can only use a thermostat. However, most thermostats are for controlling hot water valves (to control heating only), very few of them support both heating and cooling. I looked around and finally found the Tasmota-compatible BAC-002 series based on the Tuya ESP, so I bought one from AliExpress for €31.29 with free shipping.

The terminals on the back:

This thermostat is intended for controlling those 2-wire auto return ball valves, where the hot and cold water valves each have two pairs of wires, for opening and closing respectively. For controlling my AC, I only need to control the power on the "open" wire; the fan control supports three levels of speed, I can choose any one of them to use.

Since the smart thermostat needs power supply for itself but the original dumb thermostat didn't, so it didn't have a neutral line connected. But luckily there are still two wires came out from the wall that aren't used: a yellow-green ground wire, and another black wire, but unfortunately it was not connected to the main neutral. So I opened the ceiling partition where the internal AC unit is located, found the other end of the black wire and connected it to neutral.

That mysterious PCB wasn't connected to anything, maybe an unused power supply?

I connected the wires and checked that the thermostat can control the AC normally, both cooling and heating, I'm ready to flash Tasmota firmware and de-cloud it.

Hardware

After disassembling, I directly soldered the required cables to the Wi-Fi module, and started flashing Tasmota through the web flasher, but it kept prompting that the device cannot be found, neither the chip information could be read using esptool.py. After wasting hours, I found in a GitHub issue that Tuya started promoting a new product line on a large scale from 2020 - a new Wi-Fi IoT module that's compatible with the ESP modules both on physical specifications and the pins, but internally based on the Beken BK7231 series ARM SoC. Searching for the model number "WB3S" printed on this module, I confirmed that this module is one of them.

And such modules that do not use ESP chip can't be flashed with third-party firmware such as Tasmota. Due to the lack of documentation, the research on the BK7231 series isn't advancing. The most successful at present only implemented some basic MQTT functions, and the development process looks very troublesome.

The official open-source SDK from Beken supports AliOS Things, it seems slightly easier, but I still don't want to go down that rabbit hole.

Anyway, if it's not an ESP, it has to be turned into one. Since the physical specifications and pins of the module are exactly the same as the ESP12 series, it can be ditched and replaced with a real one.

I should have used a hot air gun for desoldering, the consequence of using soldering iron and a utility knife is that several pads are accidentally pulled off:

After removing the Wi-Fi module, I started to reverse engineer the circuit. Back side of the PCB:

The largest IC in the upper right corner is a "YL1621" LCD display driver, and the one in the lower right corner is a "SC05B" is capacitive touch button driver.

The main function of the thermostat is realized by the "ME32S003K6T6" (ARM) MCU in the middle, and it communicates with the Wi-Fi module through UART.

There is also an "ACE1117H" voltage regulator in the bottom right corner, after powering on the thermostat, I found that there is +12 V on its Vin pin which comes from the connecter, it can be used as the power input during test.

Since I broke several solder pads, I had to find some places for jump wires.

Software

During this period, I discovered ESPHome, which is so elegant that I abandoned Tasmota straight away after trying it out.

According to klausahrenberg/WThermostatBeca, the Wi-Fi module and the MCU communicate using some protocol on serial. This type of MCU is called Tuya MCU in ESPHome.

I soldered the required wires, prepared a piece of ESP-12F flashed with ESPHome firmware and connected it to the controller (since the Vcc pad was also slightly damaged and fragile, the module uses an external power supply temporarily for testing), I was ready to start testing.

According to the parameters in WThermostat_BAC_002_ALW.h, the datapoint mapping of this thermostat is:

datapoint	type	data
1	switch	On/Off state
2	int	Target temperature
3	int	Current temperature
4	enum	Schedule mode
5	switch	ECO (energy saving) mode
6	switch	Lock state
102	enum	HVAC mode (0: cooling, 1: heating, 2: ventilation)
103	enum	Fan mode (0: auto, 1: high, 2: medium, 3: low)
104	raw	Schedules (not yet supported by ESPHome)

According to this, I set the parameters switch_datapoint, target_temperature_datapoint, current_temperature_datapoint required by ESPHome's Tuya Climate component; in addition, according to the temperature data coefficient is 2.0 (Tuya MCU communication protocol only supports integers, for example, a value 51 actually represents 25.5 ℃), sp I set temperature_multiplier to 0.5. Configuration example:

substitutions:
  device_name: 'HVAC Thermostat'

esphome:
  name: thermostat
  comment: 'HVAC thermostat'

esp8266:
  board: esp12e
  restore_from_flash: false

preferences:
  flash_write_interval: 24h

logger:
  level: WARN
  baud_rate: 0  # disable logging to the default UART port to avoid occupying it

wifi:
  fast_connect: true
  networks:
    - ssid: !secret wifi_ssid
      bssid: !secret wifi_bssid
      password: !secret wifi_password
  domain: !secret domain_name

api:
ota:
  password: !secret ota_password

button:
  # for hard restart
  - platform: restart
    id: restart_button
    name: 'Restart ${device_name}'
    entity_category: diagnostic

# get time from HASS
time:
  - platform: homeassistant
    id: hass_time
    timezone: Europe/Madrid  # change timezone

# use UART0 to talk to the tuya MCU
uart:
  tx_pin: 1
  rx_pin: 3
  baud_rate: 9600

# enable tuya MCU component
tuya:
  time_id: hass_time  # use the time from HASS

climate:
  - platform: tuya
    id: hvac
    name: 'HVAC'
    supports_heat: true
    supports_cool: true
    switch_datapoint: 1
    target_temperature_datapoint: 2
    current_temperature_datapoint: 3
    temperature_multiplier: 0.5
    eco_datapoint: 5
    visual:
      min_temperature: 5.0
      max_temperature: 35.0
      temperature_step: 0.5

After powering on the controller, the ESPHome logs successfully dumped the Tuya MCU communication:

Home Assistant will then notify that a new ESPHome device has been discovered. After adding it, I could directly add a thermostat card to lovelace:

After checking that all the functions were working OK, I flashed the firmware to a bare ESP-12F and soldered it onto the controller, with some jump wires to several pins located on the damaged pads. To make it easier, I directly solder a pull-down resistor on the module for GPIO15. The completed modification: