Configuring PIR Sensor with CB3S Module and Tuya Chip: Step-by-Step Guide

vitya123 15 Dec 2024 14:29 4 2292 Cool? (+5)

📢 Listen (AI):

TL;DR

A PIR sensor with a CB3S module and an 8-pin Tuya chip gets converted to open-source firmware.
Programming the CB3S requires freeing shared UART Tx/Rx lines by removing the SOIC chip, removing the CB3S, or breaking the Rx/Tx traces.
The guide uses a 3.3V supply and notes an 8-pin SOIC chip on the board.
After flashing, the firmware runs with TuyaMCU and tmSensor drivers, linked DPID channels, and only MQTT settings and flags need adjustment.
GND must connect directly to the CB3S module, or the sensor resets every few seconds unless the button is pressed repeatedly.

Generated by the language model.

Here is a config guide for a PIR sensor that is not yet on the LIST.
This is the product pic borrowed from the marketplace:

after removing the PCB from the case this is what we find:

The UART lines (Tx and Rx) we use for programming the CB3S module are shared by the CB3S module and the Tuya chip (the 8 pin SOIC chip at the top left). This means we need to free these pins temporarily. This can be done in a few ways:

1. Remove the SOIC chip temporarily
2. Remove the CB3S module temporarily
3. Break the Rx/Tx lines temporarily

I opted for the first option and removed the SOIC chip with hot air. I also soldered on a few wires to strategically important places:

Red: 3.3V, Black: GND, White: Monitor/Debug

Blue: Tx, Green: Rx. You can also see the SOIC chip removed in the top left corner.

Note: The 3.3V can be connected to the battery terminal, but the GND must be connected directly to the CB3S module, otherwise it will reset every few seconds if you don't press the button every few seconds...

Using the flasher utility is straightforward. Make a backup, then upload the new firmware.
This is the Autoexec.bat file I use (with help of this forum):

startDriver TuyaMCU
startDriver tmSensor
setChannelType 1 readonly
//Link dpid al canal 1
linkTuyaMCUOutputToChannel 1 val 1
setChannelType 3 readonly
//Link dpid al canal 3
linkTuyaMCUOutputToChannel 3 val 3
SetChannel 1 2

No special configuration is needed, just change the MQTT settings and any flags you need and that's it:

At the end don't forget to remove the temporary wires and reattach the 8 pin SOIC chip.

Finished!

Here is a more detailed guide: https://diy.viktak.com/2025/02/tuya-pir-sensor-conversion-to-open-source-walkthrough.html

About Author

vitya123 wrote 51 posts with rating 10 , helped 1 times. Been with us since 2024 year.

Comments

Add a comment

@GUTEK@ 22 Dec 2024 21:22

Thanks for the description. I bought this sensor a few months ago and somehow it's been lying around, I had no idea where to use it. I reprogrammed it as described, it works fine. In HA it added me... [Read more]

vitya123 23 Dec 2024 09:01

I'm not sure. I don't have it with me right now, so I can't check, but I think it is the "reset" button on it. Can you please try and confirm this? [Read more]

spin55 23 Dec 2024 10:41

Yes, it is the battery value in Enum format and it takes three possible values: 0,1,2, which the script models to Low,Mid,High format if you modify it like this: startDriver TuyaMCU startDriver tmSensor setChannelType... [Read more]

@GUTEK@ 19 Jan 2025 19:02

I'm a bit late writing back. I set the detector like this: flags: 7, 10, 19, 35, 37 autoexec.bat file: startDriver TuyaMCU startDriver tmSensor setChannelType 1 Motion_n setChannelLabel 1 Motion linkTuyaMCUOutputToChannel... [Read more]

FAQ

TL;DR: For users flashing a CB3S Tuya PIR, 3 methods can free the shared UART, and the working forum advice is: "remove the SOIC chip temporarily." Use 3.3 V power, connect GND directly to the CB3S, flash OpenBeken, then restore the 8-pin chip and remove temporary wires. [#21349256]

Why it matters: This avoids repeated resets, preserves the original hardware, and gives Home Assistant usable motion and battery entities after flashing.

Method	What you disconnect	Thread result	Reassembly work
Remove 8-pin SOIC Tuya chip	Tuya MCU from shared Tx/Rx	Used successfully	Resolder 1 chip
Remove CB3S module	Wi-Fi module from board	Mentioned, not tested in thread	Reattach 1 module
Temporarily break Rx/Tx traces	Two UART lines	Mentioned, not tested in thread	Restore 2 traces

Key insight: The critical hardware detail is ground routing: 3.3 V can go to the battery terminal, but GND must go directly to the CB3S module. If you ground it incorrectly, the sensor resets every few seconds. [#21349256]

Quick Facts

The board uses a CB3S module and an 8-pin SOIC Tuya MCU chip that share the UART Tx and Rx lines needed for flashing, so one of three isolation methods is required first. [#21349256]
The proven wiring map is: red = 3.3 V, black = GND, white = monitor/debug, blue = Tx, and green = Rx. [#21349256]
Home Assistant exposed 2 entities after flashing in one report: entity 1 for motion state and entity 3 for battery state. [#21359258]
Battery status is an enum with 3 values: 0 = Low, 1 = Mid, 2 = High, when channel 3 is modeled as ReadOnlyLowMidHigh. [#21359673]

How do I flash a CB3S-based Tuya PIR sensor when the UART Tx and Rx lines are shared with an 8-pin Tuya MCU chip?

Free the shared UART first, then flash the CB3S normally. 1. Temporarily isolate the Tuya side by removing the 8-pin SOIC chip, removing the CB3S, or breaking the Rx/Tx lines. 2. Connect 3.3 V, direct GND to the CB3S, plus Tx and Rx. 3. Make a backup in the flasher, upload OpenBeken, then restore the removed hardware. The successful forum method was hot-air removal of the 8-pin SOIC chip. [#21349256]

What is the CB3S module, and why is it used in Tuya PIR motion sensors?

"CB3S" is a wireless module that runs the sensor firmware and handles configuration, networking, and flashing access, while sharing UART with a separate Tuya MCU on this board. In this PIR sensor, the CB3S is the part you reprogram with OpenBeken. It matters because the UART pins used for flashing are not dedicated; they are shared with the 8-pin Tuya chip, so you must isolate that chip first. [#21349256]

Why does this PIR sensor reset every few seconds unless GND is connected directly to the CB3S module instead of the battery ground?

It resets because the board ground path is not stable enough when you clip GND only to the battery side. The thread states 3.3 V can go to the battery terminal, but GND must go directly to the CB3S module. If you do not, the unit resets every few seconds unless you keep pressing the button. That behavior makes flashing unreliable and can interrupt boot or serial communication. [#21349256]

Which approach works best for freeing the shared UART lines on this sensor: removing the SOIC Tuya chip, removing the CB3S module, or temporarily cutting the Rx/Tx traces?

Removing the 8-pin SOIC Tuya chip worked best in the thread because it was actually tested and completed successfully. The post lists 3 options, but only one was used in practice: temporary SOIC removal with hot air. Removing the CB3S or cutting the Rx/Tx traces may also work, but the thread gives no result for them. That makes the SOIC-removal path the safest documented choice here. [#21349256]

What is Autoexec.bat in OpenBeken, and how does it configure TuyaMCU channels for a PIR sensor?

"Autoexec.bat" is a startup script that runs OpenBeken commands automatically at boot, defining drivers, channels, labels, and DPID links for the device. In this PIR setup it starts TuyaMCU and tmSensor, maps DPID 1 to channel 1, maps DPID 3 to channel 3, and initializes channel 1 with SetChannel 1 2. That script turns raw TuyaMCU values into usable motion and battery entities. [#21400401]

How do I wire 3.3V, GND, Tx, Rx, and a debug lead when programming this CB3S PIR sensor?

Wire it exactly as documented in the photos: red to 3.3 V, black to GND, white to monitor/debug, blue to Tx, and green to Rx. You can feed 3.3 V from the battery terminal, but connect GND directly to the CB3S module. That ground detail is not optional on this board. The post shows these 5 leads as temporary programming wires before reassembly. [#21349256]

Why does Home Assistant show entity 1 changing between 0 and 1 on this Tuya PIR sensor, and how should motion detection be interpreted?

Entity 1 is the motion state, and on this sensor the values are inverted from what many users expect. One user confirmed that entity 1 becomes 0 when motion is detected and 1 when no motion is present. If you want a cleaner motion entity in Home Assistant, configure channel 1 as Motion_n and label it Motion instead of leaving it as a plain readonly value. [#21400401]

What does entity 3 represent on this reprogrammed Tuya PIR sensor, and how do the enum values 0, 1, and 2 map to battery states?

Entity 3 is the battery level, not the reset button. The confirmed enum mapping is 0 = Low, 1 = Mid, and 2 = High. A follow-up post corrected the earlier uncertainty and showed that channel 3 can model those 3 states with ReadOnlyLowMidHigh. That gives Home Assistant a readable battery-status entity even though it is still enum-based. [#21359673]

How do I change channel 3 to ReadOnlyLowMidHigh and label it BatteryLevel in OpenBeken for this PIR sensor?

Use two commands for channel 3: setChannelType 3 ReadOnlyLowMidHigh and setChannelLabel 3 BatteryLevel. Then link the Tuya value with linkTuyaMCUOutputToChannel 3 val 3 in the simpler script, or linkTuyaMCUOutputToChannel 3 enum 3 in the Home Assistant-oriented version. The practical result is the same 3-state battery display: Low, Mid, and High. [#21400401]

Which OpenBeken channel type should I use so Home Assistant detects the sensor as a motion detector: readonly or Motion_n?

Use Motion_n if you want Home Assistant to recognize it as a motion detector. A user reported that readonly exposed raw entity values, while setChannelType 1 Motion_n plus setChannelLabel 1 Motion let Home Assistant detect a motion entity correctly. That setup also kept the inverted logic aligned with the sensor behavior reported in the thread. [#21400401]

How do flags 7, 10, 19, 35, and 37 affect the behavior of this CB3S Tuya PIR sensor after flashing?

The thread only confirms that flags 7, 10, 19, 35, and 37 were used in a working setup; it does not define each flag individually. The verified result is practical: with those flags and the posted Autoexec, Home Assistant detected a motion entity named Motion, while battery appeared as a separate 3-state entity. Do not assign exact per-flag behavior from this thread alone, because no command reference or explanation is included in the posts. [#21400401]

What is the TuyaMCU driver in OpenBeken, and how does linkTuyaMCUOutputToChannel work with DPIDs on this device?

"TuyaMCU" is a device driver that reads values from the Tuya microcontroller and exposes them to OpenBeken channels using DPIDs, which are Tuya data-point identifiers. On this PIR, DPID 1 is linked to channel 1 for motion and DPID 3 is linked to channel 3 for battery. The commands linkTuyaMCUOutputToChannel 1 val 1 and linkTuyaMCUOutputToChannel 3 val 3 perform that mapping. [#21349256]

Why is the battery entity exposed in Home Assistant but not automatically recognized as a battery sensor for this OpenBeken PIR setup?

It appears because OpenBeken exposes channel 3, but Home Assistant does not automatically classify that entity as a battery sensor in this setup. One user reported that the battery states were visible as Low, Medium, and High, yet Home Assistant still did not detect the entity as a battery class automatically. The thread also states that this limitation did not interfere with normal use. [#21400401]

What backup and safety steps should I take before removing the Tuya SOIC chip with hot air and flashing new firmware onto the CB3S module?

Make a backup first, then remove the SOIC chip carefully, and only add temporary wires where needed. 1. Use the flasher to save a backup before uploading new firmware. 2. Remove the 8-pin SOIC temporarily with hot air and avoid lifting pads. 3. After flashing, remove all temporary wires and resolder the chip. The main failure risk in the thread is unstable grounding, which causes resets every few seconds. [#21349256]

How do I finish the hardware reassembly after flashing, including removing temporary wires and resoldering the 8-pin SOIC chip?

Finish by undoing every temporary hardware change you made for flashing. Remove the added wires for 3.3 V, GND, debug, Tx, and Rx, then solder the 8-pin SOIC chip back into its original position. The original guide ends with that exact reminder after firmware upload and configuration. If you removed the chip cleanly, reassembly is simply the reverse of the prep work. [#21349256]

Generated by the language model.