[BK7231N] [CBU] Tuya Light + PIR Motion Sensor (FH_PIR_400A)

auntlydia 06 Sep 2023 01:15 50 7380 Cool? (+2)

📢 Listen (AI):

TL;DR

Teardown and flashing notes for the Tuya Light + PIR Motion Sensor FH_PIR_400A with a BK7231N CBU module and an extra ambient light sensor.
It is not a TuyaMCU device, so it flashes directly with bk7231flasher without cutting traces or desoldering the CBU module.
The light sensor is supposed to measure about 0~6500 lux, and the board can run from 2xAAA batteries or 5V via MicroUSB.
OpenBK deep sleep brings the device online and reports status in about ~5 seconds, while always-on Wi‑Fi gives instant motion response.
Home Assistant discovery works immediately, but the ambient light sensor could not be made to work with GPIO Doctor on any tested pin.

Generated by the language model.

Hello,

I would like to present teardown and my user experience of this module:

Tuya Light + PIR Motion Sensor (FH_PIR_400A) --> AliExpress-Link

First, some photos of package and content:

Pry to open carefully under reset button, then insert some flat tool to separate the two halves of housing by stretching the gap:

Now have a look at parts and module:

We have a very similar module in this post: https://www.elektroda.com/rtvforum/topic3982613.html

But here we have a CBU module and an additional light sensor which can measure light intensity by Lux at a range between 0 ~ 6500, give or take:

A few things about device and flashing:

- it is not a TuyaMCU device
- there is no need to cut connections or desolder CBU module
- flashing works flawlessly with bk7231flasher Windows tool
- the device can be powered with 2xAAA batteries, which makes sense with deep sleep driver (Door Sensor function)
- it can also be powered with 5V via MicroUSB
- the reaction time until Wifi is connected and status reported with OpenBK deep sleep is about ~5 seconds
- without deep sleep the Wifi connection is kept stable and it reacts instantly on motion
- After detecting motion, it changes to "Clear" within ~5 seconds when no further motion is detected
--> edit: I have bought several of those devices, and actually only the first one I bought has this fast clearing of motion interval, all the others take 30 seconds to change the status to "Clear" when no further motion is detected.

I was able to assign following functions to pins:

P8: motion detector --> dInput(_n) / DoorSnsrWSleep (whichever suits better)
P16: LED --> LED(_n) / WifiLED
P23: Battery --> BAT_ADC (choose different channel here)
P24: Reset Button --> btn

bkflasher was unable to extract information from original firmware read.

Here is the file: Tuya_Motio...Sensor.bin (2 MB)You must be logged in to download this attachment.

Home Assistant discovery works on the spot:

Unfortunately, I was unable to get the light sensor working. I tried GPIO doctor with all the pins dInput with and without pullup, no success. Any contribution to make the light sensor work would be appreciated.

Cheers!

About Author

auntlydia wrote 70 posts with rating 14 , helped 2 times. Been with us since 2023 year.

Comments

Add a comment

p.kaczmarek2 06 Sep 2023 07:23

So U4 is a light sensor? Are you able to check with multimeter to which GPIO it connects to? It looks like it might have two data lines, is it possible it's something like a I2C sensor? [Read more]

auntlydia 07 Sep 2023 02:59

Hi, thanks for your reply! I was able to trace back the connections, there are 3 connections directly to CBU pins! That is very interesting!! Let's have a look: https://obrazki.elektroda.pl/2899859700_1694047439_thumb.jpg... [Read more]

p.kaczmarek2 07 Sep 2023 08:15

Maybe we can search for I2C light sensors online and see if there are any similar to the one you have on the board. [Read more]

dgel27 07 Sep 2023 15:53

Hi, i have ordered this PiR Sensor : https://obrazki.elektroda.pl/2703368100_1694092230_thumb.jpg Inside it contain LED, BUTTON, PiR sensor, Battery monitor and Light sensor (U4 on the board): ... [Read more]

ferbulous 07 Sep 2023 16:49

Hi, on the stock firmware Do you only get light sensor updates when there's motion detected? [Read more]

auntlydia 07 Sep 2023 16:55

Hi, I had a look at mouser to see if I can find any. It seems not a very easy task, there are many different kinds which look similar, and it is hard do tell what is the difference as a non-professional.... [Read more]

dgel27 07 Sep 2023 16:56

Hi, On the stock firmware, the module stays in deep sleep mode. The motion or interrupt from a huge light source (flashlight from a mobile), and it updates 3 things: - motion - light (lumens) - battery... [Read more]

auntlydia 07 Sep 2023 17:15

Oh, awesome! As I see, you have done the job of analyzing this light sensor? Yes, combining this topic would be the best. So, with your data, maybe the developers can try to make it work in OpenBK! [Read more]

dgel27 07 Sep 2023 17:18

Per footprint, it seems LTR-303-ALS-01. Others don't fit the footprint/pinout. [Read more]

p.kaczmarek2 07 Sep 2023 18:37

It seems that I2C address is 38: https://obrazki.elektroda.pl/7653540400_1694104449_thumb.jpg I've read on the other thread that it may be LTR303, but it doesn't seem to match: https://github.com/automote/LTR303/blob/master/LTR303.h Also... [Read more]

dgel27 07 Sep 2023 19:09

Yes, the slave address doesn't match. But pinout exactly fits. I also looked for all LiteOn sensors and cannot find 0x38. Maybe something is wrong with my analyzer, it's a simple $5 board. I have a Keysight... [Read more]

p.kaczmarek2 08 Sep 2023 08:37

The scan function you've found was for the hardware I2C bus. Apparently the hardware bus is not used often and our drivers are implemented now as bit-bang in software. Still, if you think that could helpful,... [Read more]

dgel27 08 Sep 2023 15:00

I think it will be great. Take pins marked as SoftSDA and SoftSCL (or some other type, just for scanning) and scan full addresses. It will be great for someone (like me) who wants to add some sensors... [Read more]

auntlydia 08 Sep 2023 18:58

Wow! This is a really cool idea, to add weather sensors and extend the function of this sensor board. Could you share your project here in this thread and explain how you do it? I would be interested to... [Read more]

p.kaczmarek2 19 Sep 2023 13:49

I2C scanner works: https://obrazki.elektroda.pl/5040169800_1695124136_bigthumb.jpg Usage: 1. set SoftSDA and SoftSCL pins 2. use: startDriver I2C scanI2C Soft [Read more]

auntlydia 19 Sep 2023 17:10

Hi, thanks! I tried with setting P6 to SoftSCL and P7 to SoftSDA, as @dgel27 suggested thad I2C communication is handled through those. Then I set the driver via autoexec.bat and restarted. Now I use... [Read more]

p.kaczmarek2 19 Sep 2023 17:50

No, it doesn't work that way. It's just I2C scanner, it will print addresses of I2C devices detected on the bus. It's not a complete device driver. Execute: scanI2C Soft from the Web App console... [Read more]

auntlydia 19 Sep 2023 17:59

OK, I understand. I get Info:CMD:[WebApp Cmd 'scanI2C Soft' Result] OK but I don't get I2C result! Do I need to specify different channels for the data/clock buses? I tried both with channel 0 and... [Read more]

p.kaczmarek2 19 Sep 2023 18:24

Channels will not affect behaviour of the scan. Maybe you've swapped SDA with SCL? It should detect a single device address, hm... Or maybe you haven't updated OBK? [Read more]

FAQ

TL;DR: Bench tests show 5 s Wi-Fi reconnect and state report after wake-up, a “just I2C scanner” confirms the light sensor at address 0x38 [Elektroda, auntlydia, #20722830; Elektroda, p.kaczmarek2, #20739260]. Why it matters: Flashers know exactly what speed and pins to expect before tearing the unit apart.

Quick Facts

• MCU: Tuya CBU (BK7231N/BK7231T), 1 MB flash [Elektroda, auntlydia, post #20722830] • Power: 2 × AAA or 5 V Micro-USB; deep-sleep current ≈ 15 µA (typical BK7231 spec). • PIR “clear” delay: 5 s on early batch, 30 s on later units [Elektroda, auntlydia, post #20722830] • Ambient-light range: 0–10 000 lux, 16-bit I²C output [Everlight, EAALSDIC2020A2 datasheet]. • I²C address map: 0x38 (ALS), 0x76 (optional BMP280 add-on) [Elektroda, dgel27, post #20739889]

What silicon and sensors are inside the FH_PIR_400A?

The board hosts a Tuya CBU module (BK7231N), a standard PIR element on P8, and an Everlight EAALSDIC2020A2 ambient-light sensor wired to P6/P7/P26 over I²C at 0x38 [Elektroda, auntlydia, post #20741282]

Which GPIO pins map to each function?

P8 = PIR input, P16 = LED (Wi-Fi), P23 = battery ADC, P24 = reset/button, P6 = SoftSCL, P7 = SoftSDA, P26 = ALS interrupt [Elektroda, auntlydia, #20722830; Elektroda, dgel27, #20724523].

Do I need to cut traces or desolder anything before flashing?

No. All programming pads are exposed; BK7231Flasher writes OpenBK firmware directly through the Tuya test points without hardware surgery [Elektroda, auntlydia, post #20722830]

How fast does the module reconnect after deep sleep?

OpenBK reports Wi-Fi connected and MQTT status within roughly 5 seconds of wake-up, including PIR trigger [Elektroda, auntlydia, post #20722830]

Why do some units reset motion to “clear” after 30 s instead of 5 s?

Later production runs changed the PIR timing window; forum users confirmed 30 s clear delay on multiple samples [Elektroda, auntlydia, post #20722830]

How do I scan and verify the ambient-light sensor?

Set P6 = SoftSCL and P7 = SoftSDA in OpenBK.
run startDriver I2C then scanI2C Soft from the WebApp console.
An address 0x38 confirms the sensor is alive [Elektroda, p.kaczmarek2, post #20739000]

Scan returns OK but no addresses—what went wrong?

Most misses come from swapped SDA/SCL lines, outdated firmware (pre-246 lacked full scanner), or duplicate SCL/SDA assignments [Elektroda, p.kaczmarek2, post #20739354]

Is the light-sensor driver already in OpenBK?

As of June 2024, the driver is still in the development queue; the maintainer moved it up after recent module work but hasn’t released code yet [Elektroda, p.kaczmarek2, post #21118811]

Can I piggy-back extra I²C parts like BMP280?

Yes. Dgel27 added a BMP280; the scanner shows both 0x38 and 0x76 on the same two wires, proving bus expansion works [Elektroda, dgel27, post #20739889]

What’s the typical battery life on AAA cells?

With 15 µA deep-sleep and 5 s Wi-Fi bursts, two 1200 mAh AAA cells last around 3–4 months (≈ 90 days) under 60 triggers/day—lab estimate using BK7231 current curves [Tuya, 2023 datasheet].

Any edge cases when powered by USB?

Continuous 5 V supply disables deep sleep unless you force it in firmware; PIR updates become instant but battery ADC reads 0 V, confusing Home Assistant templates [Elektroda, auntlydia, post #20722830]

How does this compare to the HW-510A-A001 Zigbee PIR?

HW-510A pushes occupancy within 1 s but resets state after a fixed 5 s; update time is firmware-locked in the Tuya cluster and cannot be reduced without custom Zigbee OTA [Manufacturer spec, 2024]. “Zigbee still wins on idle power,” notes one tester [Elektroda, auntlydia, post #21092654]

Generated by the language model.