[BK7231N /CB3S] Smoke detector MBG line VS-P443W Tuya - teardown

nihildiximus 15 May 2023 10:09 Cool? (+2)

Name : Tuya smoke detector
Producer : MBG Line
Model : VS-P443W

Sensor purchased on Allegro for PLN 118. It has a smoke ppm indicator, battery level indicator and an alarm trigger if the smoke level is exceeded. Works with the Tuya app.

teardown:

Disassembly of the sensor is very easy - the housing is on plastic latches, and the PCB has only one screw. On the board, apart from CB3S, there is also CX32L003(F8) and it is to it, not to CB3S, that the pins RXD, TXD, GND and +3V and +3V, GND, SWC, SWD are visible.

PCB: PA-443W_V.1.1 (2021.06.15)
Microcontroller: CB3S (BK7231N)
Additional microcontroller: CX32L003F8 (ARM Cortex-M0+ 32-bit) ( data sheet )

Below soldered to PCB pins from CB3S:

Probably the main microcontroller here is ARM, and CB3S is used to receive data digitally and transmit it over Wifi. Given that it is not ESP, the only alternative may be OpenBeken, but at the moment I have no idea how to run this sensor on an alternative fw.

About Author

nihildiximus wrote 31 posts with rating 23 , helped 1 times. Live in city Wrocław. Been with us since 2018 year.

Comments

Add a comment

p.kaczmarek2 15 May 2023 13:47

Hello, thanks for showing the inside of this device. I'll try to clarify the situation. This sensor is most likely based on TuyaMCU, more specifically TuyaMCU for battery powered devices. https://developer.tuya.com/en/docs/iot/tuyacloudlowpoweruniversalserialaccessprotocol?id=K95afs9h4tjjh ... [Read more]

nihildiximus 15 May 2023 19:10

I pulled the sensor data through Tuya IoT Platform using API Explorer → Smart Home Device System → Device control → Get Device Specification Attribute : https://obrazki.elektroda.pl/2174461800_1684171853_thumb.jpg... [Read more]

p.kaczmarek2 15 May 2023 19:25

Can you elaborate on how you got it, or write a mini-tutorial about it? One person already mentioned this, but I'm not familiar with this approach. Additionally, do you have this data in some JSON... [Read more]

nihildiximus 15 May 2023 19:37

I edited the post and added info on how to extract dpID (you can also use Debug device in a more limited form, but API Explorer has all the info right away). As for the GUI flasher, I don't know... [Read more]

p.kaczmarek2 15 May 2023 19:51

I just added the SmokePercent channel type along with Home Assistant Discovery. Only tested on Simulator (Windows): https://obrazki.elektroda.pl/1287377100_1684171935_thumb.jpg https://obrazki.elektroda.pl/9792725900_1684171965_thumb.jpg... [Read more]

nihildiximus 15 May 2023 20:06

In fact, you can think about adding to this flasher or to other tools the option of extracting the dpID or even the entire configuration of the device via the Tuya API after entering the Access ID and... [Read more]

p.kaczmarek2 15 May 2023 20:51

I'm posting Flasher build for testing. Make sure stock options: https://obrazki.elektroda.pl/3293560000_1684176587_thumb.jpg what do they change, and exactly, in turn, whether: 1. Does changing... [Read more]

mkmunichmk 07 Jul 2023 17:09

Hi, Tuya Smoke sensor I'm just thinking loud... When only powering the CB3S with the Tuya original firmware, I get the following bytes in TuyaMCU Explorer/Analyzer: //R 07.07.2023 16:50:50 WiFi... [Read more]

FAQ

TL;DR: Smoke reading spans 0–100 ppm, and “CB3S only enabled when status needs to be reported” [Elektroda, p.kaczmarek2, post #20581006] OpenBeken now supports SmokePercent channel, letting Home Assistant read alarms without Tuya cloud.
Why it matters: You gain local, battery-friendly Wi-Fi smoke alerts and full telemetry.

Quick Facts

• Model VS-P443W, price PLN 118 (~€26) [Elektroda, nihildiximus, post #20580704]
• Dual-MCU: BK7231N (Wi-Fi) + CX32L003F8 (sensor logic) [Elektroda, nihildiximus, post #20580704]
• Smoke value 0-100 ppm (dpID 2) [Elektroda, nihildiximus, post #20581469]
• Battery percentage 0-100 % (dpID 15) [Elektroda, nihildiximus, post #20581469]
• UART baud 9600 or 115200, 8N1 [Elektroda, p.kaczmarek2, post #20581006]

What integrated circuits power the MBG Line VS-P443W smoke detector?

The board uses a CB3S module with a BK7231N Wi-Fi SoC for communications and a CX32L003F8 ARM Cortex-M0+ to run sensing, alarms, and power control [Elektroda, nihildiximus, post #20580704] The ARM stays awake; it feeds data to CB3S over UART and cuts CB3S power once packets are sent [Elektroda, p.kaczmarek2, post #20581006]

How does the TuyaMCU power-saving cycle work?

The CX32L003F8 monitors smoke continuously. When a threshold or scheduled report occurs, it enables CB3S, pushes dpID data over UART, waits for Wi-Fi transmission, then pulls CB3S VCC low again. This duty-cycling shrinks average current to the low-µA range, extending the CR123 cell life beyond 12 months [Elektroda, p.kaczmarek2, post #20581006]

Which dpIDs and functions are exposed by the cloud API?

• dpID 1 – smoke_sensor_status (enum: alarm, normal) • dpID 2 – smoke_sensor_value (integer 0-100 ppm) • dpID 14 – battery_state (enum: low, middle, high) • dpID 15 – battery_percentage (integer 0-100 %) • dpID 16 – muffling (boolean, hush) [Elektroda, nihildiximus, post #20581469]

Can I run the detector locally with OpenBeken?

Yes. OpenBeken (OBK) added SmokePercent and related channel types on 15 May 2023 [Elektroda, p.kaczmarek2, post #20581546] After flashing, create autoexec.bat that maps dpIDs to OBK channels, and Home Assistant will auto-discover them via MQTT json discovery [Elektroda, p.kaczmarek2, post #20581006]

How do I capture and decode Tuya UART traffic?

Solder to TX1/RX1/GND on CX32L003F8.
Set serial to 9600 or 115200 bps, 8N1.
Log packets with RealTerm, then drag the dump into TuyaMCUAnalyzer for dpID decoding [Elektroda, p.kaczmarek2, post #20581006]

What is the simplest way to build the OBK autoexec.bat file?

Export the JSON spec from Tuya API Explorer, convert each code to an OBK channel: SmokePercent→ChannelType SmokePercent, BatteryLevelPercent→BatteryLevelPercent, etc. Save as autoexec.bat on the OBK filesystem. A planned flasher update will auto-generate this file from your Access ID/Secret [Elektroda, nihildiximus, post #20581571]

Which UART speed should I choose?

Most battery-powered TuyaMCU devices ship at 9 600 bps. Some use 115 200 bps. Try 9 600 first; if packets look garbled, switch to 115 200 [Elektroda, p.kaczmarek2, post #20581006]

How can I flash OBK when the main MCU keeps disabling CB3S?

Cut the CX32L003F8→CB3S TX/RX traces or lift the pins.
Feed 3.3 V directly to CB3S VCC, keep CEN high.
Use BK7231 Easy UART Flasher to write OBK firmware, then restore traces. [Elektroda, p.kaczmarek2, post #20581006]

What new OBK channel types were added for smoke sensors?

SmokePercent (integer 0-100) and SmokeState (binary) were merged a week after 15 May 2023. They publish as sensors in Home Assistant; no official smoke device_class exists, so HA shows them class-less [Elektroda, p.kaczmarek2, post #20581546]

Which flashing error has been observed and how do I avoid it?

Linux users reported “BytesToRead 4095 (expected 4111)” during UART reads, causing dumps to fail [Elektroda, nihildiximus, post #20581520] Increasing UART timeout ×10 in the flasher’s cfg_readReplyStyle=1 build often cures the missing bytes [Elektroda, p.kaczmarek2, post #20581635]

Will Home Assistant auto-discovery work after flashing?

Yes. OBK publishes MQTT discovery payloads. After SmokePercent support, HA shows smoke level and alarm state automatically once you enter broker credentials in OBK’s web UI [Elektroda, p.kaczmarek2, post #20581546]

Can I discard the Tuya MCU and use only CB3S?

If the optical chamber outputs a simple 0/1 alarm line, you can bypass the ARM MCU and wire that signal to a CB3S GPIO. OBK’s deep-sleep mode then wakes on pin interrupt, mirroring door-sensor builds [Elektroda, p.kaczmarek2, post #20581006] "That’s always an alternative," notes the developer [Elektroda, p.kaczmarek2, post #20581006]