[BK7231N] [CBU] Tuya Light + PIR Motion Sensor (FH_PIR_400A)

auntlydia 06 Sep 2023 01:15 50 7632 Cool? (+2)

📢 Listen (AI):

TL;DR

Teardown and flashing notes for the Tuya Light + PIR Motion Sensor FH_PIR_400A with a BK7231N CBU module and an extra ambient light sensor.
It is not a TuyaMCU device, so it flashes directly with bk7231flasher without cutting traces or desoldering the CBU module.
The light sensor is supposed to measure about 0~6500 lux, and the board can run from 2xAAA batteries or 5V via MicroUSB.
OpenBK deep sleep brings the device online and reports status in about ~5 seconds, while always-on Wi‑Fi gives instant motion response.
Home Assistant discovery works immediately, but the ambient light sensor could not be made to work with GPIO Doctor on any tested pin.

Generated by the language model.

Hello,

I would like to present teardown and my user experience of this module:

Tuya Light + PIR Motion Sensor (FH_PIR_400A) --> AliExpress-Link

First, some photos of package and content:

Pry to open carefully under reset button, then insert some flat tool to separate the two halves of housing by stretching the gap:

Now have a look at parts and module:

We have a very similar module in this post: https://www.elektroda.com/rtvforum/topic3982613.html

But here we have a CBU module and an additional light sensor which can measure light intensity by Lux at a range between 0 ~ 6500, give or take:

A few things about device and flashing:

- it is not a TuyaMCU device
- there is no need to cut connections or desolder CBU module
- flashing works flawlessly with bk7231flasher Windows tool
- the device can be powered with 2xAAA batteries, which makes sense with deep sleep driver (Door Sensor function)
- it can also be powered with 5V via MicroUSB
- the reaction time until Wifi is connected and status reported with OpenBK deep sleep is about ~5 seconds
- without deep sleep the Wifi connection is kept stable and it reacts instantly on motion
- After detecting motion, it changes to "Clear" within ~5 seconds when no further motion is detected
--> edit: I have bought several of those devices, and actually only the first one I bought has this fast clearing of motion interval, all the others take 30 seconds to change the status to "Clear" when no further motion is detected.

I was able to assign following functions to pins:

P8: motion detector --> dInput(_n) / DoorSnsrWSleep (whichever suits better)
P16: LED --> LED(_n) / WifiLED
P23: Battery --> BAT_ADC (choose different channel here)
P24: Reset Button --> btn

bkflasher was unable to extract information from original firmware read.

Here is the file: Tuya_Motio...Sensor.bin (2 MB)You must be logged in to download this attachment.

Home Assistant discovery works on the spot:

Unfortunately, I was unable to get the light sensor working. I tried GPIO doctor with all the pins dInput with and without pullup, no success. Any contribution to make the light sensor work would be appreciated.

Cheers!

About Author

auntlydia wrote 70 posts with rating 14 , helped 2 times. Been with us since 2023 year.

Comments

Add a comment

p.kaczmarek2 06 Sep 2023 07:23

So U4 is a light sensor? Are you able to check with multimeter to which GPIO it connects to? It looks like it might have two data lines, is it possible it's something like a I2C sensor? [Read more]

auntlydia 07 Sep 2023 02:59

Hi, thanks for your reply! I was able to trace back the connections, there are 3 connections directly to CBU pins! That is very interesting!! Let's have a look: https://obrazki.elektroda.pl/2899859700_1694047439_thumb.jpg... [Read more]

p.kaczmarek2 07 Sep 2023 08:15

Maybe we can search for I2C light sensors online and see if there are any similar to the one you have on the board. [Read more]

dgel27 07 Sep 2023 15:53

Hi, i have ordered this PiR Sensor : https://obrazki.elektroda.pl/2703368100_1694092230_thumb.jpg Inside it contain LED, BUTTON, PiR sensor, Battery monitor and Light sensor (U4 on the board): ... [Read more]

ferbulous 07 Sep 2023 16:49

Hi, on the stock firmware Do you only get light sensor updates when there's motion detected? [Read more]

auntlydia 07 Sep 2023 16:55

Hi, I had a look at mouser to see if I can find any. It seems not a very easy task, there are many different kinds which look similar, and it is hard do tell what is the difference as a non-professional.... [Read more]

dgel27 07 Sep 2023 16:56

Hi, On the stock firmware, the module stays in deep sleep mode. The motion or interrupt from a huge light source (flashlight from a mobile), and it updates 3 things: - motion - light (lumens) - battery... [Read more]

auntlydia 07 Sep 2023 17:15

Oh, awesome! As I see, you have done the job of analyzing this light sensor? Yes, combining this topic would be the best. So, with your data, maybe the developers can try to make it work in OpenBK! [Read more]

dgel27 07 Sep 2023 17:18

Per footprint, it seems LTR-303-ALS-01. Others don't fit the footprint/pinout. [Read more]

p.kaczmarek2 07 Sep 2023 18:37

It seems that I2C address is 38: https://obrazki.elektroda.pl/7653540400_1694104449_thumb.jpg I've read on the other thread that it may be LTR303, but it doesn't seem to match: https://github.com/automote/LTR303/blob/master/LTR303.h Also... [Read more]

dgel27 07 Sep 2023 19:09

Yes, the slave address doesn't match. But pinout exactly fits. I also looked for all LiteOn sensors and cannot find 0x38. Maybe something is wrong with my analyzer, it's a simple $5 board. I have a Keysight... [Read more]

p.kaczmarek2 08 Sep 2023 08:37

The scan function you've found was for the hardware I2C bus. Apparently the hardware bus is not used often and our drivers are implemented now as bit-bang in software. Still, if you think that could helpful,... [Read more]

dgel27 08 Sep 2023 15:00

I think it will be great. Take pins marked as SoftSDA and SoftSCL (or some other type, just for scanning) and scan full addresses. It will be great for someone (like me) who wants to add some sensors... [Read more]

auntlydia 08 Sep 2023 18:58

Wow! This is a really cool idea, to add weather sensors and extend the function of this sensor board. Could you share your project here in this thread and explain how you do it? I would be interested to... [Read more]

p.kaczmarek2 19 Sep 2023 13:49

I2C scanner works: https://obrazki.elektroda.pl/5040169800_1695124136_bigthumb.jpg Usage: 1. set SoftSDA and SoftSCL pins 2. use: startDriver I2C scanI2C Soft [Read more]

auntlydia 19 Sep 2023 17:10

Hi, thanks! I tried with setting P6 to SoftSCL and P7 to SoftSDA, as @dgel27 suggested thad I2C communication is handled through those. Then I set the driver via autoexec.bat and restarted. Now I use... [Read more]

p.kaczmarek2 19 Sep 2023 17:50

No, it doesn't work that way. It's just I2C scanner, it will print addresses of I2C devices detected on the bus. It's not a complete device driver. Execute: scanI2C Soft from the Web App console... [Read more]

auntlydia 19 Sep 2023 17:59

OK, I understand. I get Info:CMD:[WebApp Cmd 'scanI2C Soft' Result] OK but I don't get I2C result! Do I need to specify different channels for the data/clock buses? I tried both with channel 0 and... [Read more]

p.kaczmarek2 19 Sep 2023 18:24

Channels will not affect behaviour of the scan. Maybe you've swapped SDA with SCL? It should detect a single device address, hm... Or maybe you haven't updated OBK? [Read more]

FAQ

TL;DR: The FH_PIR_400A is a BK7231N/CBU Wi-Fi PIR sensor that flashes without desoldering, reconnects in about 5 seconds from deep sleep, and exposes an I2C light sensor at 0x38. As one maintainer put it, "it's really an I2C device." This FAQ helps OpenBK and Home Assistant users map GPIOs, enable sleep, and troubleshoot the onboard lux sensor. [#20739934]

Why it matters: This device is unusually hackable for a Tuya battery sensor because motion, battery, button, and even the unknown light sensor are directly reachable from the CBU module.

Option	Power	Setup effort	Home Assistant path	Main trade-off
FH_PIR_400A with OpenBK	2×AAA or 5V MicroUSB	Flashing and pin setup required	Native OpenBK discovery works	Better flexibility, more work
Similar Zigbee PIR with Zigbee2MQTT	Lower battery use	Usually out-of-box	USB Zigbee coordinator + Z2M	Easier setup, less hacking

Key insight: The hard part is not flashing the FH_PIR_400A. The real blocker is identifying and driving the onboard I2C light sensor, which scans reliably at address 0x38 but still lacked a finished OpenBK driver in the thread. [#20739506]

Quick Facts

The board can run from 2×AAA batteries or 5V via MicroUSB, which makes it usable both as a battery PIR and as a permanently powered Wi-Fi sensor. [#20722830]
Deep sleep gives roughly 5 seconds from wake to Wi-Fi report, while keeping Wi-Fi active makes motion reporting effectively instant. [#20722830]
Reported lux range was described as about 0–6500 lux in testing, while the paper manual mentioned 0–10000. [#20741282]
The onboard light sensor bus was traced to P6, P7, and P26, and OpenBK later detected the device at I2C address 0x38. [#20739506]

How do I flash the Tuya FH_PIR_400A PIR motion sensor with a BK7231N CBU module using bk7231flasher without desoldering the module?

You can flash it in place, because the CBU module does not need desoldering or trace cuts. 1. Open the case carefully under the reset button and separate the housing halves. 2. Access the CBU test points, then connect bk7231flasher on Windows. 3. Flash OpenBK directly; this model was reported to flash flawlessly with bk7231flasher. The original firmware read did not yield useful extracted template data, so manual pin mapping was still required after flashing. [#20722830]

What GPIO pin mapping works for the FH_PIR_400A in OpenBK, including PIR, LED, battery ADC, and reset button?

A working OpenBK map is P8 for the PIR, P16 for the LED, P23 for battery ADC, and P24 for the reset button. The PIR was used as dInput(_n) or DoorSnsrWSleep, the LED as LED(_n) or WifiLED, the battery input as BAT_ADC, and the button as btn. One tester also reported P22 as a battery relay and used a battery coefficient of 1.97 on P23. [#20724523]

Why does the FH_PIR_400A motion status clear after about 5 seconds on some units but take around 30 seconds on others?

The clear interval varies by hardware unit or stock behavior, not by a single universal OpenBK setting shown in the thread. One tested unit changed from motion to clear in about 5 seconds, but several other units needed about 30 seconds with no further motion. That means the fast clear time is an edge case, not the default you should expect when buying multiple FH_PIR_400A sensors. [#20722830]

How can I configure deep sleep on the FH_PIR_400A in OpenBK, and what effect does it have on Wi-Fi reconnect time and motion response?

Use the PIR input as DoorSnsrWSleep when you want a battery-first configuration. Deep sleep keeps power usage sensible on 2×AAA cells, but wake-up, Wi-Fi join, and status reporting take about 5 seconds. If you disable deep sleep and keep Wi‑Fi connected, the sensor responds to motion immediately instead. That makes sleep mode better for battery life, and always-on Wi‑Fi better for low-latency automations. [#20722830]

What is a TuyaMCU device, and why does it matter that the FH_PIR_400A is not based on TuyaMCU?

"TuyaMCU" is a device architecture that uses a separate Tuya microcontroller to handle functions and exchange state with the Wi‑Fi chip over a serial protocol, instead of wiring sensors directly to the Wi‑Fi module. It matters here because the FH_PIR_400A was explicitly identified as not being a TuyaMCU device. That made direct GPIO mapping possible on the CBU module and avoided extra reverse engineering of a TuyaMCU protocol layer. [#20722830]

What is I2C, and how do SDA, SCL, and interrupt pins relate to the light sensor connections on the CBU module?

"I2C" is a two-wire serial bus that lets one host talk to multiple addressed peripherals over a shared data line and a shared clock line, while some sensors also expose an interrupt pin for threshold events. On this board, the light sensor used two bus lines plus one extra signal. The traced pins were interpreted as SCL on P6, SDA on P7, and an interrupt on P26, with the other sensor side tied to ground. [#20724523]

Which pins on the FH_PIR_400A are used by the onboard light sensor U4, and how were P6, P7, and P26 identified?

The onboard light sensor U4 uses P6, P7, and P26 on the CBU module. Those pins were identified by physically tracing three direct PCB connections from U4 back to the module pads. Later testing refined the roles: P6 as I2C clock, P7 as I2C data, and P26 as a programmable interrupt that drops when strong light triggers the threshold. [#20724523]

How do I use the OpenBK software I2C scanner with SoftSDA and SoftSCL to detect devices on pins P6 and P7?

Set P6 and P7 as the software I2C lines, start the driver, then run the scan command. 1. Assign one pin to SoftSCL and the other to SoftSDA. 2. Start the driver with startDriver I2C. 3. Run scanI2C Soft from the Web App console. A working scan on this device printed Address 0x38 (dec 56). [#20739000]

Why does scanI2C Soft return OK but show no detected I2C address in OpenBK, and what troubleshooting steps should I try?

This usually means the scan command ran, but the pin assignment or firmware build was wrong. Try three checks in order: use exactly one SDA and one SCL, swap P6 and P7 if needed, and update OpenBK to a newer build because one reported scanner version was incomplete until a later push. After updating, the same hardware began returning 0x38 correctly. Channel numbers do not affect scan behavior. [#20739484]

What does it mean when the FH_PIR_400A light sensor shows up at I2C address 0x38, and which ambient light sensors use that address?

It means the onboard lux chip is a real I2C peripheral and answers on 7-bit address 0x38, not just a passive analog sensor. That address ruled out several early guesses and focused the search on sensors that actually use 0x38. The thread later found a strong match in an Everlight ambient light sensor family with the same address and matching SDA, SCL, and INT pin positions. [#20741282]

How was the unknown light sensor in the FH_PIR_400A narrowed down from LTR-303 candidates to the Everlight EAALSDIC2020A2 family?

It was narrowed down by combining address, pinout, and register behavior. Early guesses pointed to Lite-On LTR-303 because the footprint looked similar, but the observed 0x38 slave address and logic analyzer traffic did not fit well. A later datasheet match for Everlight EAALSDIC2020A2 showed the same 0x38 address and a matching pinout, including an INT pin corresponding to P26. [#20741282]

What is the best way to reverse engineer an unknown I2C light sensor from Tuya stock firmware using a logic analyzer and datasheets?

The best method is to capture the stock firmware’s I2C transactions, then compare those register reads and writes against candidate datasheets. In this thread, that meant tracing the bus to P6/P7, confirming the sensor at 0x38, and checking whether observed commands matched likely ambient-light chips. A maintainer suggested a practical shortcut: rewrite the steps seen in the logic analyzer into code if the returned data format looks simple enough. [#20741233]

How can I add another I2C sensor like a BMP280 to the same OpenBK device and scan multiple devices on one software I2C bus?

You can wire another I2C sensor in parallel on the same SDA and SCL lines and scan the full bus. One tester added a BMP280 and later saw both devices in OpenBK: 0x38 for the onboard light sensor and 0x76 for the BMP280. That confirms the software I2C scanner supports multiple devices on one bus when the wiring and contacts are correct. [#20739889]

OpenBK Wi-Fi PIR sensor vs Zigbee PIR sensor with Zigbee2MQTT: which is better for battery life, setup effort, and Home Assistant use?

Zigbee was the better choice in the thread for battery life and easiest Home Assistant setup, while OpenBK Wi‑Fi was better for flexibility. The Zigbee option worked out of the box with a cheap USB coordinator and Zigbee2MQTT, needed no flashing, and was said to consume less power. The FH_PIR_400A offered more hardware freedom because it has both 2×AAA power and MicroUSB 5V, but setup required flashing and manual configuration. [#21092654]

How do I decrease the update time on a Zigbee PIR sensor like the HW-510A-A001 when it currently reports after about 5 seconds?

The thread did not provide a fix for reducing that Zigbee sensor’s update time. The only concrete report was a user seeing about 5 seconds on the HW-510A-A001, with no follow-up settings, firmware tweak, or hardware mod posted afterward. So the safest answer from this thread alone is that no validated method was documented there. [#21104166]

Generated by the language model.