Here I'll present my findings with a new Tuya device based on the Beken BK7238 MCU, packaged as a Tuya T1-U-HL module. For more general information relating to the T1 series and BK7238 uses see:
T1, T1-M, T1-3S Tuya BK7238 module datasheet, pinout and flashing, Home Assistant
NiceMCU XH-WB3S BK7238 Flashing, Testing, Pinout, Development, Porting
NiceMCU XH-WB3S BK7238 tutorial - quickstart, flashing, sensors, MQTT and Home Assistant
NiceMCU BK7238/T1 IR remote control support presentation tutorial - Home Assistant automations
This is a 'Soil Tester Sensor' from
Ali Express.
After popping off the battery cover, just 4 small cross-head screws allow for the removal of half the case
to reveal the main module - the T1-U-HL, a 16kb MindMotion MM32G0001 Arm Cortex-M0 TuyaMCU (also seen
here) and an HGSEMI C5551 WSAH SOIC8 chip.
Unfortunately, the back of the PCB cannot be examined without de-soldering the battery terminals. There was little to be gained, however.
T1-U-HL details -
https://developer.tuya.com/en/docs/iot/T1-U-HL-Module-Datasheet?id=Kdfp5j893qwxg
| Pin No. | Symbol | I/O type | Description |
1 | P14 | I/O | A normal GPIO pin, corresponding to Pin 19 on the IC. It can be reused as SPI_SCK. | 2 | P16 | I/O | A normal GPIO pin, corresponding to Pin 20 on the IC. It can be reused as SPI_MOSI. | 3 | P23 | I/O | A normal GPIO pin, corresponding to Pin 16 on the IC. | 4 | P22 | I/O | A normal GPIO pin, corresponding to Pin 15 on the IC. | 5 | ADC | I/O | An ADC pin, corresponding to P20 (Pin 13) on the IC. | 6 | RX2 | I/O | UART_RX2, corresponding to P1 (Pin 30) on the IC. | 7 | TX2 | I/O | UART_TX2 to print logs, corresponding to P0 (Pin 31) on the IC. | 8 | P24 | I/O | Support hardware PWM4, corresponding to Pin 17 on the IC. | 9 | P9 | I/O | Support hardware PWM3, corresponding to Pin 27 on the IC. | 10 | P26 | I/O | Support hardware PWM5, corresponding to Pin 23 on the IC. | 11 | P6 | I/O | Support hardware PWM0, corresponding to Pin 24 on the IC. | 12 | P8 | I/O | Support hardware PWM2, corresponding to Pin 26 on the IC. | 13 | GND | P | Ground pin. | 14 | 3V3 | P | 3.3V power pin. | 15 | TX1 | I/O | UART_TX1 to send user data, corresponding to P11 on the IC (corresponding to Pin 29 on the IC). | 16 | RX1 | I/O | UART_RX1 to receive user data, corresponding to P10 on the IC (corresponding to Pin 28 on the IC). | 17 | P28 | I/O | A normal GPIO pin, corresponding to Pin 12 on the IC. | 18 | CEN | I/O | The reset pin, active low, and pulled up internally. It is compatible with the designs of other modules. Corresponding to Pin 11 on the IC. | 19 | P21 | I/O | A normal GPIO pin, corresponding to Pin 14 on the IC. | 20 | P17 | I/O | A normal GPIO pin, corresponding to Pin 22 on the IC. It can be reused as SPI_MISO. | 21 | P15 | I/O | A normal GPIO pin, corresponding to Pin 21 on the IC. It can be reused as SPI_CS |
Feeding 3V through the batters terminals and from TX2 the boot log is captured at 115200 baud:
Unfortunately, the MindMotion MCU gets in the way of any flash read efforts on RX1/TX1, even with the MCU Nrst held low, so the module had to be hot air gun removed for flashing away from the MCU.
Easy Flasher reads whole flash successfully in BK7238 mode
As a precaution a backup is also taken with
BKFIL
Regarding the TSSOP20 MM32 MCU (datasheet attached) we read this overview
And to put how it connects to the 4 test pads and to the T1-U-HL in context:
Maybe I should have another go at reading the flash with J-Link, I appear to have been unsuccessful with the other device.
With the backup flashed to the NiceMCU and setup to talk to the
Tuya Module Debugging Assistant with product ID
rknwi0ctbbghzgla we can pair it with the Tuya app to check firmware versions, device appearance, options and readings
It seems it's just a glorified temperature and humidity sensor.
with the Tuya app linked to a dev account we can retrieve the dpIDs, needed for OpenBK7238 setup
which when made pretty:
Interesting, separate dpIDs for Fahrenheit and a switcher dpID. I don't see a change function in the app. The manual offers no clues.
OpenBK7238 flashed over the top of factory firmware. I chose to overwrite the bootloader because keeping the factory BL meant OTA updates were not successful.
PCB and module cleaned up. Excess solder removed with solder braid.
It appears the top two pads are only there to secure module to PCB - no traces on either side. It looks like P21 goes somewhere but I've yet to get any continuity to any component.
With the module soldered back in and OBK unconfigured, you get 20s from button-push wake-up until the MCU withdraws power from the T1 module. This gives just about enough time to navigate to the web app, create autoexec and set a starting script
With a basic starter:
I get no readings and no response to
tuyaMcu_sendQueryState. Flag 26 ([UART] Use alternate UART for BL0942, CSE, TuyaMCU, etc) toggled doesn't change that.
This is where I will pause to investigate TuyaMCU comms to the NiceMCU with TMDA and to research the HGSEMI chip.
IMG_0172.JPG
(2.28 MB)
You must be logged in to download this attachment.
IMG_0171.JPG
(2.22 MB)
You must be logged in to download this attachment.
Comments
TMDA says it is receiving a heartbeat from the NiceMCU https://obrazki.elektroda.pl/6584532900_1754942580_bigthumb.jpg but OBK doesn't log a valid heartbeat ExtraDebug:TuyaMCU:TuyaMCU heartbeat_valid... [Read more]
Very nice analysis, here's some little info from me - as far as I know, tuyaMcu_sendQueryState is only for core TuyaMCU (non-battery powered). So it is fully expected for battery powered (tmSensor) to... [Read more]
OK sure, but on NiceMCU with no tmsensor running I would expect to see TuyaMCU responses in OpenBK7238 log. No heartbeat or any commands manually sent from TMDA are shown as received. [Read more]
If the device is using Battery Powered Tuya Serial Protocol, then it will not reply to classic TuyaMCU driver. tmSensor (Battery Powered Tuya Protocol) is different, and, as far as I remember, the MCU... [Read more]
but to be sure OBK7238 itself works alright with TuyaMCU I switched to NiceMCU and TMDA. BK-N dev receives commands OK, BK7238 does not. Same autoexec on both. No tmsensor running, only TuyaMCU. [Read more]
So you are saying that you are sending non-battery powered commands from TMDA? That could mean UART driver is not working correctly in BK7238 build. [Read more]
yes sir. take soil sensor out of the equation. take battery tmsensor out of the equation = OBK7238 doesn't seem to receive responses from TuyaMCU simulator whereas OBK7231 does. I can do it again to... [Read more]
back again. NiceMCU / Tuya Module Debugging Assistant TX/RX over P0/P1: TuyaMCU driver only. TMDA acknowledges heartbeats and will send query state response to BK7238 but BK7238 only prints this... [Read more]
Info:TuyaMCU:Received: 55 AA 03 01 00 46 7B 22 70 22 3A 22 72 6B 6E 77 69 30 63 74 62 62 67 68 7A 67 6C 61 22 2C 22 76 22 3A 22 31 2E 30 2E 30 22 2C 22 6D 22 3A 31 2C 22 6D 74 22 3A 31 2C 22 6E 22 3A 30... [Read more]
https://obrazki.elektroda.pl/2606030100_1760609181_thumb.jpg https://obrazki.elektroda.pl/6246030300_1760609133_thumb.jpg https://obrazki.elektroda.pl/1521551900_1760609184_thumb.jpg ... [Read more]
not sure what this means. You can only select one chip mode at a time in Easy Flasher https://obrazki.elektroda.pl/9803788000_1760675717_thumb.jpg T1-U-HL is BK7238 [Read more]
And if you have multiple T1 devices, you should either do "Show advanced options" -> "Restore RF part", or "Show advanced options" -> "Custom operation" -> "Restore RF from backup". "Restore... [Read more]
https://obrazki.elektroda.pl/1668353700_1760765466_thumb.jpg I don't have a T1 chip. How do I add it? [Read more]
use the latest Easy Flasher https://github.com/openshwprojects/BK7231GUIFlashTool/releases/ [Read more]
Everything is clear) I'm stupid)) I'm using the 2023 firmware [Read more]
:) Added after 55 : don't forget to take a full backup first [Read more]
Thanks, to be honest, I've never needed backups before) I'll try to post a few of my devices on the forum soon [Read more]
never say never! they could help with config setup and are useful for general analysis and, if shared, can go into the collection: https://github.com/openshwprojects/FlashDumps/tree/main/IoT [Read more]
OK, I can make and share [Read more]