{"id":3789,"date":"2019-12-21T17:03:00","date_gmt":"2019-12-22T01:03:00","guid":{"rendered":"http:\/\/www.stevenrhine.com\/?p=3789"},"modified":"2026-04-22T11:20:51","modified_gmt":"2026-04-22T18:20:51","slug":"king-electric-atmoz-wifi-single-pull-v3-1-ota-th1250wf-teardown","status":"publish","type":"post","link":"https:\/\/www.stevenrhine.com\/?p=3789","title":{"rendered":"King Electric ATMOZ1-240-WIFI Single Pole V3.1-OTA TH1250WF Line Volt Thermostat Tear Down."},"content":{"rendered":"\r\n

King Electric Atmoz Wifi <\/a>(Archive<\/a>) V3.1-OTA TH1250WF Line Volt Thermostat Tear Down And Quick Review.. <\/strong>

\"\"<\/a> \u00a0\"\"<\/a><\/p>\r\n

(Update 2025 These Thermostats No Longer Work with the Smart\/Remote Features)
\u00a0
Let Me Save you Some Reading Time.. This Thermostat Currently is a Big Waste of Time and Money.
If You Want to Use The App and Smart Home Features There May Be a Undisclosed Privacy Risk!<\/em><\/strong>

So Far this Device as a manual thermostat is good. but as for the Android App Atmoz and Atmoz 2 is a major failure..
It looks to be a server issue with King Electric’s<\/a> Smart Home Data Partner Ayla Networks<\/a> More on that Down Further!!!

Read More If You Wish..\u00a0<\/strong><\/em>
Powered Up.. Has A Nice Display..
\"\"<\/a>
As it Was Out of the Box..
\"\"<\/a> \"\"<\/a>
To Open it it is just one screw you have to open it to be able to mount it on the wall. Yes there is a Non Attached Cover that goes between boards. Removed for Photo. PCB Marked TH1250PWF-V1-1807
\"\"<\/a> \"\"<\/a>\u00a0
Back Side Of Power Relay Board Held In with 2 Small Screws. Again Mixed House Brand Capacitors.. I Did Not Bother Removing the Front PCB Yet. I Will Later and Get the Display Info. The Switching Relay is a 24V 16A SCHRACK – TE CONNECTIVITY RT314024<\/a> So it may last a while.. I would really like to see a 20A Here though..\u00a0\u00a0
\"\"<\/a> \"\"<\/a>\u00a0
Wi-Fi Card is an AMPAK WSDB750GN WiFi-MCU Module FCC Data<\/a> & User Manual<\/a> Local Archive<\/a>
\"\"<\/a> \"\"<\/a> \"\"<\/a>
10\/29\/2025<\/span> From the FCC Internal Photos it appears to be a 25L1608E<\/a> under the shielding I will do a backup attempt of the wifi module would like to do it externally but may have to remove the shielding to do so. (10\/30\/2025<\/span> This is a Custom Module 2 Castellated boards soldered together)\u00a0

April 15 2026<\/strong><\/span> Now that the weather is getting warmer I can risk one of these Thermostats, I Removed the RF Shielding This has a Broadcom BCM43362KUBG, STM32F411CE6<\/a> Both Wafer-Level Chip Scale Package (WLCSP) and a Serial Eeprom a 26Q16 not a 25l160E on the FCC Site. Ill Start with\u00a0
\"\"<\/a>
MCU is a Renesas Technology Corp RL78\/L13 R5F10WMCA<\/strong> (Data Sheet<\/a>) Used for Display.\u00a0
\"\"<\/a> \"\"<\/a> \"\"<\/a>\u00a0
Schematic of The R5F10WMCA<\/strong> Chip It Shows Controlling Display and Thermal Couplers and Front Panel Buttons.
\"\"<\/a>
LCD Pin Out.

11\/30\/2024, It Looks like My Segger Flasher 5 Pro Supports this MCU But with Renasas its probably locked with a code or security bit. When i get a chance I will attempt a backup.
\"\"<\/a> \"\"<\/a>
Pin\u00a0 out Form Data Sheet Looks Like Pins 9 is TOOL0 and Pin 10 is Reset CON2 is where they to\u00a0 Tool0 Pin 3 \/ Reset Pin 4
\"\"<\/a>
Looking at the Segger Flasher Pro<\/a> Configuration for the Device I do not see any type of flash ID just a General Security Bit, SO If the Security is not active we should be able to get a read in system.
\"\"<\/a>

Decoding The MCU Info.
R = Renesas<\/i>
5 = MCU
F = Flash
10W = RL78\/L13 Group
M = 80-pin
C = 32KB Rom
A = Consumer applications, operating ambient temperature -40\u00b0C to 85\u00b0C<\/p>\r\n

Figured they Would Have Used A Code
G, L = Industrial applications, operating ambient temperature -40\u00b0C to 105\u00b0C<\/p>\r\n

Or Even Better
K, M = Industrial applications, operating ambient temperature -40\u00b0C to 125\u00b0C
Y = Industrial applications, operating ambient temperature -40\u00b0C to +150\u00b0C

Jumper Locations And Some Other Connectors! CON2 Is MCU Programming Header
\"\"<\/a> \"\"<\/a> \"\"<\/a>
CON2 Pinouts (Pin 1 has the box around it.)
1 VDD
2 GND
3 TOOL0
4 RESET

Update 10\/29\/2025 <\/span>a little bit more reverse engineering time!\u00a0 Ticking away the hours.\u00a0
I Did some more studding on this device since it is now a necessity to repair it now that king electric manufacturing broke it.
Info from probing around.

Con3 (Appears to be Serial UART) I may have to hook it up to see if I can get a terminal. but the signals appear to be serial.\u00a0 \u00a0
1 VDD 3.3V
2 RDX?
3 TXD?
4 GND

Con4 (Appears Wifi Programming Header or Another UART \/ Debug?)<\/del> No it was another MCU possibly the STM32F411CE6
1 VDD
2 SWDIO?
3 CLK ?
4 RST ?\u00a0
5 GND

Schematic Clip of the Wifi Module My pin outs are confirmed.\u00a0
\"\"<\/a>

10\/30\/2025<\/span> Something did not look right.. So I took the board out to see the reverse side and investigate a little bit further as I could not trace out the pins to the wifi module or mcu.\u00a0
when i Pulled the board found another MCU hidden under the display…\u00a0
\"\"<\/a>
STM32F030C8T6<\/a> that Explains the Signals above on connector 4 Ill trace it out. This is probably where all the cheesiness spyware is!! The FCC info did not show this to have an MCU. This must be some soft of custom board. with the wifi module on the top.\u00a0
\"\"<\/a>
I will give it a look with the Xeltek ISO1<\/a> o the Segegr Flasher Pro<\/a> attempt a backup but it’s prob locked!\u00a0
\"\"<\/a>
04\/15\/2026<\/span> Weather is getting warmer. I have retaken a X-ray of the PCB after removing the RF Shield and Removing the Serial Eeprom,\u00a0 40KV was not powerful enough to push thru the RF Shielding.\u00a0
\"\"<\/a><\/p>\r\n

Sept 2025, The weather is getting cooler and its time to tun the heat on and no Wifi Control!
I had some extra time so I wired this unit up to attempt a backup with the Segger Flasher Pro \/ Portable Plus.
\"\"<\/a>
I went cave man as I did not have any 2.00mm strip headers handy.\u00a0
\"\"<\/a><\/p>\r\n

Looks like I should\u2019ve read a little deeper into the R5F10WMCA<\/strong> datasheet. Turns out the RL78 Series chips can\u2019t just be read with a regular in-system flash programmer Just Erase, Program, & Verify. The\u00a0 RL78 Series need an E2 emulator\/debugger and a bunch of extra setup. Plus, debugging has to be enabled and the debug monitor installed which probably isn\u2019t the case here.<\/p>\r\n

There are some reverse-engineering tricks out there, but they can be risky and even destructive to the device. I checked the device lists for my Xeltek, BPM Microsystems, and Data I\/O programmers, but no luck none of them support an off-board parallel read. So doing something\u00a0 like I was able to do with the Hakko FM-203 firmware recovery<\/a> is off the table. That said I still have another backup target, the Wi-Fi card! I believe it uses a 25L1608E serial EEPROM from the FCC Data<\/a> I looked at with the shield removed. I\u2019ll have to take a closer look and see if there\u2019s an external way to back it up since the shielding is soldered on. not sure how much further I want to go.

\"\"<\/a>
04\/15\/2026<\/strong> <\/span>Now that the weather is getting warmer I can risk one of these Thermostats, I Removed the RF Shielding and Removed the Serial Eeprom 25Q16 that contains the firmware.
\"\"<\/a>
The Serial Eprom 25Q16 is Prepared for Backup.
\"\"<\/a>
Back up with the Xeltek Superpro 6100N Read and Verify Success…\u00a0
\"\"<\/a>
Confirm some Data… You can see Ayla Networks this lead me to this Github for Ayla API Unofficial<\/a>
\"\"<\/a>
You Can Also See King I this is KING I ELECTRONICS CO. LTD<\/a> in Taiwan..\u00a0
\"\"<\/a>
Exposing more Fraud<\/strong><\/em><\/span> from King Electrical Manufacturing Company they print on their box Made By King Electrical Mfg Co. that is not True! Having custom firmware and a box is not the same thing as Manufacturing The Device.\u00a0\u00a0
\"\"<\/a>
KING I ELECTRONICS CO. LTD<\/a> in Taiwan KingI Catalog<\/a> Pages Kinda Definitive proof. I wonder who makes the Hoot?\u00a0
\"\"<\/a> \"\"<\/a>
STM32F411CE6<\/a> I think this chip may hold some firmware also I will attempt to read it with an ST Link or the Flasher Pro May be able to do this backup via Uart Also but i am not that skilled in Uart.\u00a0
\"\"<\/a>

For what they are charging for these I would think that would go with Name Brand Capacitors but Nope!! Cheap House \/ Generic Brands! Yes Brands Multiple.
\"\"<\/a> \"\"<\/a>

The App’s are Broken!! The apps will Install and Allow you to Sign Up and you will get an e-mail. But the E-mail is Not Complete!! The Link is there but hidden Missing image or Text.. So the link is Hidden below the Activation \/ Verification Code See 2nd Image.
\"\"<\/a> \"\"<\/a>\u00a0
When you Click empty space to trigger the link they sent from your device on the E-mail The Link Launches the App and Will not take Password says it is wrong.
\"\"<\/a>
This is the Link.. IN the Browser..
“https:\/\/app-launcher.aylanetworks.com\/launch?custom_url=kingI-th1250wf:\/\/user_sign_up_token?token=%5B%5Buser_confirmation_token%5D%5D”

The web browser that open gives a 500 Error…
“{“error”:{“code”:”500″,”message”:”500 – Internal server error. The server encountered an internal error or misconfiguration and was unable to complete your request. Please contact the server administrator, admin@aylanetworks.com, and inform them of the time the error occurred. More information about this error may be available in the server error log.”}}”

\u00a0\"\"<\/a>

Atmoz 1 app Will let you log in with a Gmail account But the Atmoz 2 app will Not it gives an Error, And the Face Book Connect Is Broken on both.
\"\"<\/a> \"\"<\/a>

The to Enable the Alexa Skill it requires you to link your account Ayla Networks. “Not King Electronics” Via Ayla Networks (Sign in Link<\/a>) !! King Electric and Ayla if you cannot complete the Sign Up process for an account you cannot link your account to the Atmoz Alexa Skill..

Ayla Networks Phone # Just Goes o Voice Mail..
King Electronics Also Just Goes to Voice Mail..
Facebook Both No Answer..
NO TECH SUPPORT Evening or Weekends = Bad!! I can get a 6.00 China Smart Wifi switch and if there is an issue a Facebook or twitter Response is min’s away..

I was able to get in but it took a little work figuring out and editing their link from a closer inspection of the HTML Above e-mail on a PC.. (%5B%5B) was replaced with (avhx4FFu) your code will be different..

“https:\/\/app-launcher.aylanetworks.com\/launch?custom_url=kingI-th1250wf:\/\/user_sign_up_token?token=avhx4FFu”

You have to do this for both apps.. I am not sure why? it makes it way to complex..

I hope the above and the following helps people having issues.. A Person should not have to spend an entire Saturday messing with something trying to figure out why Aylan Networks and King Electric have these errors!

Update: 9:08 PM I am Still Trying to Link the Alexa Skill But Now Account is Locked.. I Guess To many Log In Attempts LOL…
\"\"<\/a>

Ok, I have Insomnia!

It 10:45 PM I have Connected to Atmoz (1) App, I was able to validate and Log In by making my own link from the e-mails.

I was able to Enable the Alexa Skill and Connect to the Ayla Networks.

I was able to Get Alexa to Discover the Device! Alexa

Another Issue. The Reset Button on the Side Would NOT Reset the Wifi to Default.

I had to turn off The 1st Router I connected to under my Gmail Login, Reset the Device, Connect Wifi Direct to The Atmoz, and Connect Phone to another Internet Enabled router to be able to login and have the Atmoz app discover the device. Then plug the Main Router Back in, and Set it Up!!

This software is buggy as hell.. Way over complicated!! I hope I do not have to go thru this much hassle to reset the wifi again if I change a SSID or Want to Connect to another network.

After this experience there is No way would I would pay the price because of the poor build quality, poor software, complex setup, and!!

The Other Big Thing!!

That King Electric is outsourcing the Data Custodian of these Devices to Ayla Networks which is worrisome has me wondering if Ayla Networks can be trusted with the meta data collect from the app.. Here is their (Privacy Policy<\/a>) Do a google search ayla data collection and sales.

I had to learn this without any upfront disclosure on the King Website, Catalog Page<\/a>, Printing on the Box, or on the google play app page<\/a>. All the photo’s say Atmoz by King.. it should be disclose upfront that Ayla Networks handles the data not King. What is funny in their November 7th What’s New “Fix Password Error Message For Registration”.. Nope King You Did Not Fix It!!

\"\"<\/a>

As of Now With The King Line Volt Wifi Thermostat Do Not Walk But Run Away or Just Buy the K702E-2 SIMPLSTAT or One of the other Wifi Choices. For Line Volt Thermostats

Update: 09\/2021
This thermostat has major bugs #1 is it will loose it s settings and the heater will come on unexpectedly, Will not hold set temp if using the panel controls but will if using the app. Still searching for an affordable alternative.\u00a0

Update\u00a0 11\/30\/2024<\/p>\r\n

King Is killing These Off!
\"\"<\/a>

Atmoz-EOL-Customer-Letter-2024<\/a>

Update 09\/11\/2025<\/span>
Progress With King Electric.. the Right to Repair Schematics, and Firmware. I spoke with a Brad Wilson VP of the company. We discussed the right to repair and a possible solution to the Atmoz thermostats wifi connectivity being broken by King Electric, we discussed we discussed replacements I expressed how he should replace them for everyone not just me, making the source code available so we the community can make our own home assistant control to restore its functionality at our own expense or king having their vendor do he said it was not given to them as an option but he would check. He insisted and said would send me replacement hoot’s. So, There may be hope for the Atmoz owners.\u00a0<\/p>\r\nhttps:\/\/www.stevenrhine.com\/wp-content\/uploads\/2019\/12\/King-Electrical-Manufacturing-Atmoz-VP-Brad-Wilson-and-Rhine-09-11-2025.mp3<\/a><\/audio>\r\n


09\/17\/2025 \u00a0Brad Wilson sent some illegible UL paperwork thinking it would be OK for the documents part.. They are not legible a total slap in the face!\u00a0
Pages from ATMOZ UL Report 160726126GZU_CDR_V4 .2-1<\/a>

October 13th 2025 Wife complained it was cold so I turned the breakers for the heating system on within about an Hour I received an e-mail form Alya Systems that the account has been deleted. I have not received a reply or the replacement brad said he would send.\u00a0
\"\"<\/a>\u00a0

<\/p>\r\n

October 15th 2025 Wife has a hard time seeing and using these thermostats in manual mode So, I made sure king was aware and that we needed to get this resolved!\u00a0
\"\"<\/a>
All I received the crickets so I pushed a little harder we needed to get this resolved or I was going to escalate this to small claims court.\u00a0

The reply was Basically he said I was threatening and cyber bulling and just flat out rude and disrespectful. He Never did send the replacement units as he insisted he would back in September.<\/p>\r\n

He again I feel Mocks My Wife Disability!
\u00a0
This is the message that sealed the seal for the escalation was the 2nd time he made comments like this.
\"\"<\/a>

10-31-2025<\/span> the Discussions Stalled and This Situation has Escalated into a Law Suit. I don’t like it when people break my stuff.\u00a0<\/p>\r\n