Elektroda.com
Elektroda.com
X
Elektroda.com

CB3S / BK7231N: Generic Tuya wireless temperature/humidity sensor with LED

lukedashjr 330 12
  • #1
    lukedashjr
    Level 3  
    CB3S / BK7231N: Generic Tuya wireless temperature/humidity sensor with LED CB3S / BK7231N: Generic Tuya wireless temperature/humidity sensor with LED

    Was able to flash OpenBK7231N_QIO_1.12.54.bin, but it crashes within a minute of booting (whether wifi is configured or not).

    I can only read the first 1150976 bytes, and observe the OpenBK images are 1220464 bytes - so maybe they're too big? idk



    Had to boot up a Windows system to use encrypt.exe to decrypt the factory firmware backup and get it back to stock...

    Added after 10 [minutes]:

    P.S. If someone wants me to try anything, the clock is ticking: I got this specifically because it said it supported below freezing, but it doesn't (the LED display went nuts). So regardless of firmware hacking stuff, I'm returning it.

    P.P.S. Any suggestions for a non-cloud-able (preferably open source firmware) temperature/humidity sensor that runs on batteries and I can stick in freezers?
  • #2
    p.kaczmarek2
    Level 27  
    Is this a TuyaMCU device? It certainly looks like it.

    Have you tried older OBK version?

    The N platform problem was already reported and a temporary solution that we came up with was to flash full 2MB and thus override all config etc partitions. See attachment. Try flashing it.

    Remember to change your MAC in settings afterwards

    The issue is problematic to debug, because for me, on my few N devices, everything seems to work.
    CB3S / BK7231N: Generic Tuya wireless temperature/humidity sensor with LED
    it's almost like only the new batches from factory are affected
  • #3
    lukedashjr
    Level 3  
    p.kaczmarek2 wrote:
    Is this a TuyaMCU device? It certainly looks like it.

    I don't know how to tell, but other threads here suggested UART flashing would fail with TuyaMCU, and it didn't fail (I just had to hold my probes on the terminals firmly).

    p.kaczmarek2 wrote:
    Have you tried older OBK version?
    I did also try OpenBK7231N_QIO_1.12.33.bin but it didn't work any better.

    p.kaczmarek2 wrote:
    The N platform problem was already reported and a temporary solution that we came up with was to flash full 2MB and thus override all config etc partitions. See attachment. Try flashing it.

    Is there any way to backup the full 2 MB? My backups cut off at ~1.1 MB... Hesitant to try anything that would possibly prevent me from returning it.
  • #4
    lukedashjr
    Level 3  
    Managed to make a full 2 MB backup, and flashed your FullFW.bin. However, after doing so, nothing shows up on wifi. It does display a (possibly-correct) temperature and humidity on the LED, though.

    Added after 1 [hours] 18 [minutes]:

    Code:

    340728aa
    SYS:000000df          0040192c 00000158
    ST:00000000
    J 0x10000
    bk_misc_init_start_type 0 0
    prvHeapInit-start addr:0x4113c0, size:126016
    [Flash]id:0xeb6015
    sctrl_sta_ps_init
    cset:0 0 0 0
    Entering init log...
    Init log done!
    Commands registered!
    bandgap_calm_in_efuse=0x67
    [load]bandgap_calm=0x67->0x27,vddig=4->5
    [FUNC]rwnxl_init
    [bk]tx_txdesc_flush
    [FUNC]intc_init
    [FUNC]calibration_main
    gpio_level=1,txpwr_state=0
                              user define rfcali mode:1
    get rfcali_mode:1
    calibration_main over
                         NO TXPWR_TAB_TAB found in flash
    Load default txpwr for b:0xb0928
    Load default txpwr for g:0xb0936
    fit n20 table with dist:4
    Load default txpwr for n40:0xb0944
    Load default txpwr for ble:0xb17bd
    temp in flash is:350
    xtal in flash is:12
    xtal_cali:12
    --init_xtal = 12
                    [FUNC]ps_init
    [FUNC]func_init_extended OVER!!!

    start_type:0
    Version:
    Initializing TCP/IP stack
    tcp_port:62642
    app_init finished
    Debug:CMD:Adding command loglevel
    Debug:CMD:Adding command logfeature
    Debug:CMD:Adding command logtype
    Debug:CMD:Adding command logdelay
    Debug:CFG:flash vars not initialised - reading
    Debug:CFG:new offset after read 548, boot_count 16, success count 0
    Info:CFG:####### Boot Count 17 #######
    Debug:CFG:new offset 580, boot_count 17, success count 0
    Debug:CFG:new offset after read 580, boot_count 17, success count 0
    Debug:CFG:re-read - offset 580, boot count 17, boot success 0, bootfailures 17
    Info:MAIN:###### safe mode activated - boot failures 17
    Debug:CFG:HAL_Configuration_ReadConfigMemory: read 2016 bytes to 1904640
    Warn:CFG:CFG_InitAndLoad: Config crc or ident mismatch. Default config will be loaded.
    Info:MAIN:Using SSID []

    Info:MAIN:Using Pass []

    Debug:MAIN:Started http tcp server

    Debug:MAIN:started timer

    Info:MAIN:[SAFE] Time 1, free 96296, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 2/38

    Info:MAIN:[SAFE] Time 2, free 96296, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 2/38

    Info:MAIN:[SAFE] Time 3, free 96296, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 2/38

    Info:MAIN:[SAFE] Time 4, free 96296, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 2/38

    temperature_type=2
                      temp_code:28 - adc_code:343 - adc_trend:[13]:350->[14]:340
    Info:MAIN:[SAFE] Time 5, free 96296, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 2/38

    Info:MAIN:no flash configuration, use default

    Info:MAIN:set ip info: 192.168.4.1,255.255.255.0,192.168.4.1

    Info:MAIN:ssid:OpenBK7231N_8C000000  key: mode:0

    hostapd_main_exiting
    hostapd_exit_handler
    hostapd_exit_done
    Soft_AP_start
    [saap]MM_RESET_REQ
    [bk]tx_txdesc_flush
    [saap]ME_CONFIG_REQ
    [saap]ME_CHAN_CONFIG_REQ
    [saap]MM_START_REQ
    hapd_intf_add_vif,type:3, s:0, id:0
    apm start with vif:0
    me_set_ps_disable:840 0 0 1 0 0
    ------beacon_int_set:100 TU
    set_active param 0
                      [msg]APM_STOP_CFM
                                       update_ongoing_1_bcn_update
    vif_idx:0, ch_idx:0, bcmc_idx:1
    update_ongoing_1_bcn_update
    enter low level!
    mac c8:47:8c: 0: 0: 1
    leave low level!
    net_wlan_add_netif done!, vif_idx:0
    uap_ip_start

    configuring interface uap (with Static IP)def netif is no ap's netif, sending boardcast or no-subnet ip packets may failed
    sending broadcast_deauth:5
    Info:MAIN:[SAFE] Time 6, free 88048, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:MAIN:[SAFE] Time 7, free 88048, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:MAIN:[SAFE] Time 8, free 88048, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:MAIN:[SAFE] Time 9, free 88048, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    sta: 0, softap: 1, b/g/n
    softap:ssid=OpenBK7231N_8C000000,channel=1,dhcp=1,cipher_type:OPEN
    Info:MAIN:[SAFE] Time 10, free 88048, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:GEN:dhcp=0 ip=0.0.0.0 gate=0.0.0.0 mask=0.0.0.0 mac=00:00:00:00:00:00

    Info:GEN:ip=192.168.4.1,gate=255.255.255.255,mask=255.255.255.0,dns=192.168.4.1

    Info:MAIN:[SAFE] Time 11, free 88048, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:MAIN:[SAFE] Time 12, free 88048, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    hapd_intf_sta_add:1, vif:0
    rc_init: station_id=0 format_mod=0 pre_type=0 short_gi=0 max_bw=0
                                                                     rc_init: nss_max=0 mcs_max=255 r_idx_min=0 r_idx_max=11 no_samples=10
                        sta_idx:0, pm_state:0
    ctrl_port_hdl:1
    Info:MAIN:[SAFE] Time 13, free 87856, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:MAIN:[SAFE] Time 14, free 87856, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:MAIN:[SAFE] Time 15, free 87856, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:MAIN:[SAFE] Time 16, free 87856, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:MAIN:[SAFE] Time 17, free 87856, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:MAIN:[SAFE] Time 18, free 87856, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:MAIN:[SAFE] Time 19, free 87856, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    sta: 0, softap: 1, b/g/n
    softap:ssid=OpenBK7231N_8C000000,channel=1,dhcp=1,cipher_type:OPEN
    Info:MAIN:[SAFE] Time 20, free 87856, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:GEN:dhcp=0 ip=0.0.0.0 gate=0.0.0.0 mask=0.0.0.0 mac=00:00:00:00:00:00

    Info:GEN:ip=192.168.4.1,gate=255.255.255.255,mask=255.255.255.0,dns=192.168.4.1


    Added after 2 [hours] 6 [minutes]:

    I have come to believe the TuyaMCU is grounding reset/enable after 25-30 seconds.

    Hoping startDriver TuyaMCU might make it behave - but the boot failure count quickly gets high enough for safe mode where this doesn't work :/

    Is there any way to reset the boot failure count?

    Added after 17 [minutes]:

    Re-flashed to clear boot failure count. startDriver TuyaMCU didn't help :(

    Added after 12 [minutes]:

    Code:

    01ffc 340728aa
    SYS:000000df          0040192c 00000158
    ST:00000000
    J 0x10000
    bk_misc_init_start_type 0 0
    prvHeapInit-start addr:0x4113c0, size:126016
    [Flash]id:0xeb6015
    sctrl_sta_ps_init
    cset:0 0 0 0
    Entering init log...
    Init log done!
    Commands registered!
    bandgap_calm_in_efuse=0x67
    [load]bandgap_calm=0x67->0x27,vddig=4->5
    [FUNC]rwnxl_init
    [bk]tx_txdesc_flush
    [FUNC]intc_init
    [FUNC]calibration_main
    gpio_level=1,txpwr_state=0
                              user define rfcali mode:1
    get rfcali_mode:1
    calibration_main over
                         NO TXPWR_TAB_TAB found in flash
    Load default txpwr for b:0xb0928
    Load default txpwr for g:0xb0936
    fit n20 table with dist:4
    Load default txpwr for n40:0xb0944
    Load default txpwr for ble:0xb17bd
    temp in flash is:350
    xtal in flash is:12
    xtal_cali:12
    --init_xtal = 12
                    [FUNC]ps_init
    [FUNC]func_init_extended OVER!!!

    start_type:0
    Version:
    Initializing TCP/IP stack
    tcp_port:62642
    app_init finished
    Debug:CMD:Adding command loglevel
    Debug:CMD:Adding command logfeature
    Debug:CMD:Adding command logtype
    Debug:CMD:Adding command logdelay
    Debug:CFG:flash vars not initialised - reading
    Debug:CFG:new offset after read 100, boot_count 2, success count 0
    Info:CFG:####### Boot Count 3 #######
    Debug:CFG:new offset 132, boot_count 3, success count 0
    Debug:CFG:new offset after read 132, boot_count 3, success count 0
    Debug:CFG:re-read - offset 132, boot count 3, boot success 0, bootfailures 3
    Debug:CFG:HAL_Configuration_ReadConfigMemory: read 2016 bytes to 1904640
    Warn:CFG:CFG_InitAndLoad: Config crc or ident mismatch. Default config will be loaded.
    Info:MAIN:Using SSID []

    Info:MAIN:Using Pass []

    Debug:MAIN:Started http tcp server

    Debug:CMD:Adding command startDriver
    Debug:CMD:Adding command addRepeatingEvent
    Debug:CMD:Adding command showgpi
    Debug:CMD:Adding command setChannelType
    Debug:CMD:Adding command showChannelValues
    Debug:MAIN:Initialised pins

    Info:MQTT:MQTT_RegisterCallback called for bT obk8C000000/ subT obk8C000000/+/set
    Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obk8C000000/ subT cmnd/obk8C000000/+
    Debug:CMD:Adding command publish
    Debug:MAIN:Initialised other callbacks

    Debug:CMD:Adding command power
    Debug:CMD:Adding command powerStateOnly
    Debug:CMD:Adding command powerAll
    Debug:CMD:Adding command color
    Debug:CMD:Adding command backlog
    Debug:CMD:Adding command exec
    Debug:CMD:Adding command addcmd
    Debug:CMD:Adding command led_dimmer
    Debug:CMD:Adding command led_enableAll
    Debug:CMD:Adding command led_basecolor_rgb
    Debug:CMD:Adding command led_basecolor_rgbcw
    Debug:CMD:Adding command led_temperature
    Debug:CMD:Adding command led_brightnessMult
    Debug:CMD:Adding command led_colorMult
    Debug:CMD:Adding command led_saturation
    Debug:CMD:Adding command led_hue
    Debug:CMD:Adding command sendGet
    Debug:CMD:Adding command SetChannel
    Debug:CMD:Adding command AddChannel
    Debug:CMD:Adding command ClampChannel
    Debug:CMD:Adding command SetPinRole
    Debug:CMD:Adding command SetPinChannel
    Debug:CMD:Adding command GetChannel
    Debug:CMD:Adding command GetReadings
    Debug:CMD:Adding command ShortName
    Debug:CMD:Adding command AddEventHandler
    Debug:CMD:Adding command AddChangeHandler
    Debug:CMD:Adding command listEvents
    Debug:CMD:Adding command restart
    Debug:CMD:Adding command clearConfig
    Debug:CMD:cmd [exec autoexec.bat]
    Debug:CMD:exec autoexec.bat
    Error:CMD:lfs is absent
    Info:GEN:PIN_SetupPins pins have been set up.

    Debug:MAIN:started timer

    Info:MAIN:Time 1, free 94664, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 2/38

    Info:MAIN:Time 2, free 94664, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 2/38

    Info:MAIN:Time 3, free 94664, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 2/38

    Info:MAIN:Time 4, free 94664, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 2/38

    Info:MAIN:Time 5, free 94664, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 2/38

    Info:MAIN:no flash configuration, use default

    Info:MAIN:set ip info: 192.168.4.1,255.255.255.0,192.168.4.1

    Info:MAIN:ssid:OpenBK7231N_8C000000  key: mode:0

    hostapd_main_exiting
    hostapd_exit_handler
    hostapd_exit_done
    Soft_AP_start
    [saap]MM_RESET_REQ
    [bk]tx_txdesc_flush
    [saap]ME_CONFIG_REQ
    [saap]ME_CHAN_CONFIG_REQ
    [saap]MM_START_REQ
    hapd_intf_add_vif,type:3, s:0, id:0
    apm start with vif:0
    me_set_ps_disable:840 0 0 1 0 0
    ------beacon_int_set:100 TU
    set_active param 0
                      [msg]APM_STOP_CFM
                                       update_ongoing_1_bcn_update
    vif_idx:0, ch_idx:0, bcmc_idx:1
    update_ongoing_1_bcn_update
    enter low level!
    mac c8:47:8c: 0: 0: 1
    leave low level!
    net_wlan_add_netif done!, vif_idx:0
    uap_ip_start

    configuring interface uap (with Static IP)def netif is no ap's netif, sending boardcast or no-subnet ip packets may failed
    sending broadcast_deauth:5
    temperature_type=2
                      temp_code:29 - adc_code:342 - adc_trend:[13]:350->[14]:340
    Info:MAIN:Time 6, free 86416, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:MAIN:Time 7, free 86416, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:MAIN:Time 8, free 86416, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:MAIN:Time 9, free 86224, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    sta: 0, softap: 1, b/g/n
    softap:ssid=OpenBK7231N_8C000000,channel=1,dhcp=1,cipher_type:OPEN
    Info:MAIN:Time 10, free 86224, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:GEN:dhcp=0 ip=0.0.0.0 gate=0.0.0.0 mask=0.0.0.0 mac=00:00:00:00:00:00

    Info:GEN:ip=192.168.4.1,gate=255.255.255.255,mask=255.255.255.0,dns=192.168.4.1

    Info:MQTT:mqtt_userName homeassistant
    mqtt_pass qqqqqqqqqq
    mqtt_clientID obk8C000000
    mqtt_host 192.168.0.113:1883

    Info:MQTT:Connect error in mqtt_client_connect - code: -4

    Info:MAIN:Time 11, free 86224, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:MAIN:Time 12, free 86224, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    Info:MAIN:Time 13, free 86224, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 5/38

    hapd_intf_sta_add:1, vif:0
    rc_init: station_id=0 format_mod=0 pre_type=0 short_gi=0 max_bw=0
                                                                     rc_init: nss_max=0 mcs_max=255 r_idx_min=0 r_idx_max=11 no_samples=10
                        sta_idx:0, pm_state:0
    ctrl_port_hdl:1
    Debug:CMD:cmd [startDriver TuyaMCU]
    Debug:CMD:Adding command tuyaMcu_testSendTime
    Debug:CMD:Adding command tuyaMcu_sendCurTime
    Debug:CMD:Adding command uartSendHex
    Debug:CMD:Adding command tuyaMcu_fakeHex
    Debug:CMD:Adding command linkTuyaMCUOutputToChannel
    Debug:CMD:Adding command tuyaMcu_setDimmerRange
    Debug:CMD:Adding command tuyaMcu_sendHeartbeat
    Debug:CMD:Adding command tuyaMcu_sendQueryState
    Debug:CMD:Adding command tuyaMcu_sendProductInformation
    Debug:CMD:Adding command tuyaMcu_sendState
    Debug:CMD:Adding command tuyaMcu_sendMCUConf
    Debug:CMD:Adding command fakeTuyaPacket
    Debug:CMD:Adding command tuyaMcu_setBaudRate
    Info:NTP:Started TuyaMCU.

    Info:MAIN:Time 14, free 57872, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 7/38

    Info:MAIN:Time 15, free 44192, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 8/38

    Debug:CMD:cmd [tuyaMcu_setBaudRate 115200]
    Info:MAIN:Time 16, free 44192, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 8/38

    Info:MAIN:Time 17, free 44192, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 8/38

    Debug:CMD:cmd [tuyaMcu_sendHeartbeat]
    Debug:CMD:cmd [tuyaMcu_sendMCUConf]
    Info:MAIN:Time 18, free 71552, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 6/38

    Debug:CMD:cmd [tuyaMcu_sendMCUConf]
    Info:MAIN:Time 19, free 71568, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 6/38

    sta: 0, softap: 1, b/g/n
    softap:ssid=OpenBK7231N_8C000000,channel=1,dhcp=1,cipher_type:OPEN
    Info:MAIN:Time 20, free 71568, MQTT 0, bWifi 0, secondsWithNoPing 0, socks 6/38

    Info:GEN:dhcp=0 ip=0.0.0.0 gate=0.0.0.0 mask=0.0.0.0 mac=00:00:00:00:00:00

    Info:GEN:ip=192.168.4.1,gate=255.255.255.255,mask=255.255.255.0,dns=192.168.4.1

    Debug:CMD:cmd [tuyaMcu_sendMCUConf]


    (Skipping tuyaMcu_setBaudRate didn't help)

    Added after 2 [minutes]:

    Note that explicitly rebooting the device does NOT start the "timer" over - it still dies after 25-30 seconds from the initial boot (not the reboot).

    Added after 29 [minutes]:

    Pressing the button on the device appears to reboot the CB3S.

    I'm wondering if the TuyaMCU is only supposed to power it up "as needed" to report data - I notice it shows the temperature even after/while the CB3S is dead.

    But the paper included with it says it has an "AP Mode" which sounds like it would need the CB3S constantly active...

    (I actually think I'd prefer it to spawn OpenBK only as-needed to report temperature, but I need to get OpenBK configured for that first at least! But I also note that when I _did_ manage to configure my wifi, OpenBK failed to connect saying the password was wrong - it wasn't)

    Added after 35 [minutes]:

    Ok, so the CB3S power comes from R2, which comes from C1 - which I am guessing is a capacitor (sorry, I'm not an electronics person so not sure) that the TuyaMCU charges when it wants to.

    Connecting 3.3V directly to CB3S gets it to survive beyond the 20 seconds.

    "AP mode" is apparently _just_ for setup, and not a persistent AP. So that may not help me either. :/

    Added after 1 [hours] 4 [minutes]:

    Perhaps a bigger issue: I'm not seeing any useful data from TuyaMCU when I have it running.
  • #5
    p.kaczmarek2
    Level 27  
    Thank you for your research.
    You are correct with TuyaMCU resetting WiFi module.
    I think it would be worthwhile for you to consult those links:
    My considerations and research of similar issue (translated from Polish, not yet finalized):
    https://www.elektroda.com/rtvforum/topic3914412.html
    Tuya docs:
    https://developer.tuya.com/en/docs/iot/tuyacl...niversalserialaccessprotocol?id=K95afs9h4tjjh
    CB3S / BK7231N: Generic Tuya wireless temperature/humidity sensor with LED
    see the diagram above, the TuyaMCU waits 30 seconds for BK7231 to send data on UART first

    lukedashjr wrote:

    Perhaps a bigger issue: I'm not seeing any useful data from TuyaMCU when I have it running.

    This is correct. The WiFi module is supposed to send something first.

    Here is my quick stub of driver for that, not finished:
    https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/driver/drv_tuyaMCUSensor.c
    There is my very crude way to send data to TuyaMCU after 3 seconds in driver has elapsed:
    Code: c
    Log in, to see the code

    but the basics should be working, please consult linked Elektroda topic for details
    https://www.elektroda.com/rtvforum/topic3914412.html


    Extra Hint: you can change the number of seconds required for boot to be marked as okay in the settings. Change it to lower value if you are getting failed boots all the time.
  • #6
    lukedashjr
    Level 3  
    Any reason to wait 3 seconds? Can I just put these things in an autoexec?
  • #7
    p.kaczmarek2
    Level 27  
    The command used in autoexec (or in short startup command) is in the topic I linked before. You start two drivers - tuyaMCU and tmSensor driver. The latter resides on top of tuyaMCu driver and sends packets.

    Regarding 3 seconds... no real reason, I just wanted to let things settle up. It's an experimental setup. I am not sure if it will work for your device. Remember that also you might need to discover dpIds later - which variable ID is temperature, which is humidity, etc. Still, it should be easy, just look at integer values and look at the screen.

    The temperature might be send as integer even if it has fractional part on screen - it's just sending eg. 255 for 25.5C, 199 for 19.9C, etc. I saw that in TH06 temperature sensor, if I remember correctly.

    Remember, this is an experimental setup.some things may be missing, but I can help with implementation if that's needed
  • #8
    lukedashjr
    Level 3  
    tmSensor didn't help at all - I think it may have actually made it kill power sooner :/

    Rigged this, but it also results in power getting killed sooner:

    Code:
    backlog startDriver tuyaMCU; tuyaMcu_sendProductInformation; addRepeatingEvent 4 999 uartSendHex 55aa00020001040655aa00060008011209111009050159; addRepeatingEvent 4 999 uartSendHex 55aa000a0001000a55aa00050001000655AA00100002010012; ; tuyaMcu_sendQueryState;
  • #9
    p.kaczmarek2
    Level 27  
    There are many things that can go wrong. Even a different baud ratio for UART is possible.

    What I'd try doing, is disconnecting RX/TX from WiFi module and trying to interface the MCU with PC, sending packets from RealTerm and checking if it responds.

    If you have an original 2MB firmware backup, then it should be also possible to connect RX pin from UART to USB converter to either TX-RX or RX-TX line and watch the communication between MCU an WiFiModule.

    This is the way I use to debug TuyaMCU IoT devices.
  • #10
    lukedashjr
    Level 3  
    Disconnecting things and soldering is beyond my skill. It's the most I can do to hold the probes on the pins to power and flash it. :/
  • #11
    p.kaczmarek2
    Level 27  
    Ok, then there is an easier option - you just need to make WiFi module powered by 3.3V permanently and just test things in OBK console, see how the MCU responds to queries, etc.
  • #12
    lukedashjr
    Level 3  
    Not sure how to do that without soldering either?
  • #13
    p.kaczmarek2
    Level 27  
    Then maybe let's go with non-soldering route - restore original flash and then try watching the communication between TuyaMCU module and WiFi module, see what happens on both RX-TX and TX-RX lane. Determine what is being sent by original WiFi module to TuyaMCU so TuyaMCU is not turned off after 30 seconds. See how is the LCD data sent (temperature? date? etc?).