[BK7231N] Tuya Temperature & Humidity Monitor: Teardown, Hackability & Features Explained

Question

Teardown of this battery powered temperature & humidity monitor from AliExpress It's very hack-able, just 2 screws and it opens right up, nice accessible board, very easy to break-out: CB3S chip; assume it's BK7231N like CB2S? Also packing TuyaMCU: I took capture of communication stream. Expect...

p.kaczmarek2 · Answer

This is an interesting device. I had a similiar one or two, but a Zigbee-based version and an USB-powered one, not requiring batteries. Let me check the packets data. This will be crucial for extending the support for new device types in the future. It seems that you've found some new data that I do not support yet. Thanks. That will be helpful for further research. I can see that this device is using the 00 version of TuyaMCU, i.e. the battery devices protocol. This packet contains date: Code: text Expand Select all Copy to clipboard 55 AA 00 06 00 08 01160B0E0C2E1101 89 HEADER VER=00 Unk LEN bOk=1 22/11/14 12:46:17 CHK I have yet to find where the temperature is stored, but I should be able to find it in Tuya Docs, so no problems here. The device should be easily supportable by OBK, but indeed, we might need to add a sleep version for that. Or do we? Can you check, is the CB3S in this device always powered, or does it gets disconnected by TuyaMCU? There are some low power devices that have a TuyaMCU which controls power of WiFi module through a N-MOSFET. TuyaMCU can just turn off totally WiFi module and save power. WiFi module is only enabled from time to time when it's needed. What is Q1 on the board doing? Dodano po 10 [minuty]: I have extended my app a little and I can see humidity and temperature data (temperature data is sent as integer and then divided by 10): There are much more variables but I don't know the meaning of them. What could be 390 (with fnId 10) and 60 or 20?

TurkeyMan · Answer

Well, I have actually been trying to work out why I can't find the device's DHCP lease for hours, but it just occurred to me a few hours ago, it must be that the wifi chip is completely shutting down rather than 'sleeping', and it seems to be explicitly releasing it's lease from the AP before it does, so I never actually caught it in the act.
The options in SmartLife allow to set the report interval, and by default, it reports just once ever 120 minutes! So, it seems it only wakes up every 2 hours to report, but dumps a fairly high resolution update between intervals filling the empty time.
I configured for 1-minute report interval when logging that traffic, so each if those [wait] moments I list are a 1-minute interval when it catches up. I guess that's why the packets feel quite long...

So, apparently turning the chip off completely is perfectly fine, and turns out that 2-hours report interval is accepted by industry... if you can model that, I'm sure the battery will go for ages.
Please do make it possible to adjust the report interval though!

p.kaczmarek2 · Answer

So there is no problem with no deep sleep in OBK, as the TuyaMCU will disable WiFI module anyway.

Do you have any idea what other fnIDs might be? I got temperature, humidity and date. Is there anything else we need to find? Hmmm... battery level.

Regarding report interval... well. If the TuyaMCU does the waking up of WiFi module, then we can't do much about it, can we? We don't flash TuyaMCU, just the WiFI module.

TurkeyMan · Answer

Well, the report frequency is configurable. It's 2 hours by default, but I changed it to 1 minute for sampling the comms stream.
The wifi module must communicate the report time to the TuyaMCU if it's being switched off and then switched back on again after the interval delay...

p.kaczmarek2 · Answer

It's configurable? Well, then we must find where the frequency is stored. Maybe try to record changing it to 1minute, then to 5 minutes, and then to 10?

Futhermore, what are the markings of TuyaMCU and of the LCD driver?

TurkeyMan · Answer

Here's a bunch more data captured from the TX pin; BK -> TuyaMCU.
At startup, all the configuration values are transmit to the Tuya.

Device profiles probably need to exist to know which values are available, and allow users to specify values for each of the configuration items.


TX pin: (bootup sequences)

**All defaults** (I suspect defaults are not transmit to TuyaMCU, you can see the TX data is shorter)
Unit: C
Temp report: 120 min
Humidity report: 120 min
Temp sensitivity: 0.6C
Humidity sentitivity: 6%
Temp min/max: 0C - 39C
Humidity min/max: 20% - 60%

0055AA000100000055AA0002000103
0555AA00020001040655AA00050001000555AA00050001000555AA00050001000555AA0005000100
0555AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA0005000100
0555AA00050001000555AA00050001000555AA0006000801160B1012182D039955AA000500010005
55AA00050001000555AA00050001000555AA0005000100050055AA000100000055AA000200010204
55AA00020001030555AA00020001040655AA0010000201001255AA00050001000555AA0005000100
0555AA0006000801160B10121901036E00 

Temp report: 1 min      (these options manage wifi wake frequency for reporting == battery use)
Humidity report: 1 min
0055AA000100000055AA00020001
020455AA00020001030555AA00020001040655AA00050001000555AA00050001000555AA00050001
000555AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA00050001
000555AA00050001000555AA00050001000555AA00050001000555AA0006000801160B10121B3403
A355AA00050001000555AA00050001000555AA00050001000555AA0005000100050055AA00010000
0055AA00020001020455AA00020001030555AA00020001040655AA00100012010212020004000000
0111020004000000015555AA00050001000555AA00050001000555AA00050001000555AA00050001
000555AA0006000801160B10121C0A037A55AA00050001000555AA00050001000555AA0005000100
0555AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA0005000100
0555AA000500010005000055AA000100000055AA00020001030555AA00020001040655AA00100002
01001255AA0006000801160B10121C3703A755AA00050001000555AA00050001000555AA00050001
000500 

Temp report: 2 min
Humidity report: 3 min
0055AA000100000055
AA00020001020455AA00020001030555AA00020001040655AA00050001000555AA00050001000555
AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA00050001000555
AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA0006000801160B
10121D2C039D55AA00050001000555AA00050001000555AA00050001000555AA0005000100050055
AA000100000055AA00020001020455AA00020001030555AA00020001040655AA0010001201021202
00040000000311020004000000025855AA00050001000555AA00050001000555AA00050001000555
AA00050001000555AA0006000801160B10121E00037255AA00050001000555AA00050001000555AA
00050001000555AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA
00050001000555AA00050001000500 

Temp report: 5 min
Humidity report: 8 min
55AA000100000055AA000200
01020455AA00020001030555AA00020001040655AA00050001000555AA00050001000555AA000500
01000555AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA000500
01000555AA00050001000555AA00050001000555AA00050001000555AA0006000801160B10122030
03A455AA00050001000555AA00050001000555AA00050001000555AA0005000100050055AA000100
000055AA00020001020455AA00020001030555AA00020001040655AA0010001F0104110200040000
00051202000400000008090400010014020004000000069D55AA00050001000555AA000500010005
55AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA000600080116
0B10122106037B55AA00050001000555AA00050001000555AA00050001000555AA00050001000555
AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA00050001000500

** Changing all the other options **
Unit: F
Temp sensitivity: 0.4C
Humidity sensitivity: 3%
Temp min/max: 1.9C - 36.7C
Humidity min/max: 23% - 57%
55AA000100000055AA
00020001030555AA00020001040655AA00050001000555AA00050001000555AA00050001000555AA
00050001000555AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA
00050001000555AA00050001000555AA00050001000555AA0006000801160B10122C0A038A55AA00
050001000555AA00050001000555AA00050001000555AA000500010005000055AA000100000055AA
00020001020455AA00020001030555AA00020001040655AA00100047010914020004000000030904
00010111020004000000780D0200040000001712020004000000780B020004000000130A02000400
00016F0C020004000000391302000400000004E155AA00050001000555AA00050001000555AA0005
0001000555AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA0005
0001000555AA00050001000555AA00050001000555AA00050001000555AA0006000801160B10122C
1F039F55AA0006000801160B10122C1F039F55AA0006000801160B10122C1F039F55AA0005000100
0555AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA0005000100
0555AA00050001000555AA00050001000555AA00050001000500 

Unit: F
Temp sensitivity: 3.6F   (probably transmit 2.0C - NOTE: UI CHANGED TO F AFTER LAST BOOTUP)
Humidity sensitivity: ??  (I forgot to write down what I set... it might be 20%, or maybe I didn't change it and it's still 3%, or something else!)
Temp min/max: -3.1F - 120.7F  (probably transmit -19.5C - 49.3C)
Humidity min/max: 17% - 97%
55AA000100000055AA000200
01030555AA00020001040655AA00050001000555AA00050001000555AA00050001000555AA000500
01000555AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA000500
01000555AA00050001000555AA00050001000555AA0006000801160B10123208038E55AA00050001
000555AA00050001000555AA00050001000555AA0005000100050055AA000100000055AA00020001
020455AA00020001030555AA00020001040655AA00100037010713020004000000140A0200040000
01ED0C020004000000610D02000400000011140200040000001409040001010B020004FFFFFF3D98
55AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA000500010005
55AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA000600080116
0B1012321C03A255AA0006000801160B1012321C03A255AA0006000801160B1012321C03A255AA00
050001000555AA00050001000555AA00050001000555AA00050001000555AA00050001000555AA00
050001000555AA00050001000555AA00050001000555AA00050001000500

The config UI changes all the values from C to F after I applied the first change to F.
My guess is that the last test where I chose to submit F values will actually convert and submit those values in C?

Added after 22 [minutes]:

Also, since the user can send these values, we should know the limits.
Maybe the limits are just from the config UI, but maybe the limits are hardware limits, so I guess we should follow them.

Unit convert: C / F (maybe a bool value: 0 - C (no convert), 1 - F (convert)
Temp report: 1-120 min - 1 min increment
Humidity report: 1-120 min - 1 min increment
Temp sensitivity: 0.3-2.0C - 0.1C increment
Humidity sentitivity: 3-20% - 1% increment
Temp min/max: -20.0-60.0C - 0.1C increment
Humidity min/max: 0-100% - 1% increment

Added after 1 [hours] 30 [minutes]:

p.kaczmarek2 wrote:
Futhermore, what are the markings of TuyaMCU and of the LCD driver?

I updated OP with additional photos, including good images of the additional chips.

p.kaczmarek2 · Answer

Please check modified quotes: Spoiler: Show Code: text Expand Select all Copy to clipboard TX pin: (bootup sequences) **All defaults** (I suspect defaults are not transmit to TuyaMCU, you can see the TX data is shorter) Unit: C Temp report: 120 min Humidity report: 120 min Temp sensitivity: 0.6C Humidity sentitivity: 6% Temp min/max: 0C - 39C Humidity min/max: 20% - 60% 55 AA 00 01 00 00 00 HEADER VER=00 Product LEN CHK 55 AA 00 02 00 01 03 05 HEADER VER=00 McuConf LEN 03 CHK 55 AA 00 02 00 01 04 06 HEADER VER=00 McuConf LEN 04 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 06 00 08 01160B1012182D03 99 HEADER VER=00 Unk LEN bOk=1 22/11/16 18:24:45 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 01 00 00 00 HEADER VER=00 Product LEN CHK 55 AA 00 02 00 01 02 04 HEADER VER=00 McuConf LEN 02 CHK 55 AA 00 02 00 01 03 05 HEADER VER=00 McuConf LEN 03 CHK 55 AA 00 02 00 01 04 06 HEADER VER=00 McuConf LEN 04 CHK 55 AA 00 10 00 02 0100 12 HEADER VER=00 Unk LEN 0100 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 06 00 08 01160B1012190103 6E HEADER VER=00 Unk LEN bOk=1 22/11/16 18:25:1 CHK Temp report: 1 min      (these options manage wifi wake frequency for reporting == battery use) Humidity report: 1 min 55 AA 00 01 00 00 00 HEADER VER=00 Product LEN CHK 55 AA 00 02 00 01 02 04 HEADER VER=00 McuConf LEN 02 CHK 55 AA 00 02 00 01 03 05 HEADER VER=00 McuConf LEN 03 CHK 55 AA 00 02 00 01 04 06 HEADER VER=00 McuConf LEN 04 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 06 00 08 01160B10121B3403 A3 HEADER VER=00 Unk LEN bOk=1 22/11/16 18:27:52 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 01 00 00 00 HEADER VER=00 Product LEN CHK 55 AA 00 02 00 01 02 04 HEADER VER=00 McuConf LEN 02 CHK 55 AA 00 02 00 01 03 05 HEADER VER=00 McuConf LEN 03 CHK 55 AA 00 02 00 01 04 06 HEADER VER=00 McuConf LEN 04 CHK 55 AA 00 10 00 12 010212020004000000011102000400000001 55 HEADER VER=00 Unk LEN 010212020004000000011102000400000001 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 06 00 08 01160B10121C0A03 7A HEADER VER=00 Unk LEN bOk=1 22/11/16 18:28:10 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 01 00 00 00 HEADER VER=00 Product LEN CHK 55 AA 00 02 00 01 03 05 HEADER VER=00 McuConf LEN 03 CHK 55 AA 00 02 00 01 04 06 HEADER VER=00 McuConf LEN 04 CHK 55 AA 00 10 00 02 0100 12 HEADER VER=00 Unk LEN 0100 CHK 55 AA 00 06 00 08 01160B10121C3703 A7 HEADER VER=00 Unk LEN bOk=1 22/11/16 18:28:55 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK Temp report: 2 min Humidity report: 3 min 55 AA 00 01 00 00 00 HEADER VER=00 Product LEN CHK 55 AA 00 02 00 01 02 04 HEADER VER=00 McuConf LEN 02 CHK 55 AA 00 02 00 01 03 05 HEADER VER=00 McuConf LEN 03 CHK 55 AA 00 02 00 01 04 06 HEADER VER=00 McuConf LEN 04 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 06 00 08 01160B10121D2C03 9D HEADER VER=00 Unk LEN bOk=1 22/11/16 18:29:44 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 01 00 00 00 HEADER VER=00 Product LEN CHK 55 AA 00 02 00 01 02 04 HEADER VER=00 McuConf LEN 02 CHK 55 AA 00 02 00 01 03 05 HEADER VER=00 McuConf LEN 03 CHK 55 AA 00 02 00 01 04 06 HEADER VER=00 McuConf LEN 04 CHK 55 AA 00 10 00 12 010212020004000000031102000400000002 58 HEADER VER=00 Unk LEN 010212020004000000031102000400000002 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 06 00 08 01160B10121E0003 72 HEADER VER=00 Unk LEN bOk=1 22/11/16 18:30:0 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK Temp report: 5 min Humidity report: 8 min 55 AA 00 01 00 00 00 HEADER VER=00 Product LEN CHK 55 AA 00 02 00 01 02 04 HEADER VER=00 McuConf LEN 02 CHK 55 AA 00 02 00 01 03 05 HEADER VER=00 McuConf LEN 03 CHK 55 AA 00 02 00 01 04 06 HEADER VER=00 McuConf LEN 04 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 06 00 08 01160B1012203003 A4 HEADER VER=00 Unk LEN bOk=1 22/11/16 18:32:48 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 01 00 00 00 HEADER VER=00 Product LEN CHK 55 AA 00 02 00 01 02 04 HEADER VER=00 McuConf LEN 02 CHK 55 AA 00 02 00 01 03 05 HEADER VER=00 McuConf LEN 03 CHK 55 AA 00 02 00 01 04 06 HEADER VER=00 McuConf LEN 04 CHK 55 AA 00 10 00 1F 01041102000400000005120200040000000809040001001402000400000006 9D HEADER VER=00 Unk LEN 01041102000400000005120200040000000809040001001402000400000006 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 06 00 08 01160B1012210603 7B HEADER VER=00 Unk LEN bOk=1 22/11/16 18:33:6 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK ** Changing all the other options ** Unit: F Temp sensitivity: 0.4C Humidity sensitivity: 3% Temp min/max: 1.9C - 36.7C Humidity min/max: 23% - 57% 55 AA 00 01 00 00 00 HEADER VER=00 Product LEN CHK 55 AA 00 02 00 01 03 05 HEADER VER=00 McuConf LEN 03 CHK 55 AA 00 02 00 01 04 06 HEADER VER=00 McuConf LEN 04 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 06 00 08 01160B10122C0A03 8A HEADER VER=00 Unk LEN bOk=1 22/11/16 18:44:10 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 01 00 00 00 HEADER VER=00 Product LEN CHK 55 AA 00 02 00 01 02 04 HEADER VER=00 McuConf LEN 02 CHK 55 AA 00 02 00 01 03 05 HEADER VER=00 McuConf LEN 03 CHK 55 AA 00 02 00 01 04 06 HEADER VER=00 McuConf LEN 04 CHK 55 AA 00 10 00 47 01091402000400000003090400010111020004000000780D0200040000001712020004000000780B020004000000130A0200040000016F0C020004000000391302000400000004 E1 HEADER VER=00 Unk LEN 01091402000400000003090400010111020004000000780D0200040000001712020004000000780B020004000000130A0200040000016F0C020004000000391302000400000004 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 06 00 08 01160B10122C1F03 9F HEADER VER=00 Unk LEN bOk=1 22/11/16 18:44:31 CHK 55 AA 00 06 00 08 01160B10122C1F03 9F HEADER VER=00 Unk LEN bOk=1 22/11/16 18:44:31 CHK 55 AA 00 06 00 08 01160B10122C1F03 9F HEADER VER=00 Unk LEN bOk=1 22/11/16 18:44:31 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK Unit: F Temp sensitivity: 3.6F   (probably transmit 2.0C - NOTE: UI CHANGED TO F AFTER LAST BOOTUP) Humidity sensitivity: ??  (I forgot to write down what I set... it might be 20%, or maybe I didn't change it and it's still 3%, or something else!) Temp min/max: -3.1F - 120.7F  (probably transmit -19.5C - 49.3C) Humidity min/max: 17% - 97% 55 AA 00 01 00 00 00 HEADER VER=00 Product LEN CHK 55 AA 00 02 00 01 03 05 HEADER VER=00 McuConf LEN 03 CHK 55 AA 00 02 00 01 04 06 HEADER VER=00 McuConf LEN 04 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 06 00 08 01160B1012320803 8E HEADER VER=00 Unk LEN bOk=1 22/11/16 18:50:8 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 01 00 00 00 HEADER VER=00 Product LEN CHK 55 AA 00 02 00 01 02 04 HEADER VER=00 McuConf LEN 02 CHK 55 AA 00 02 00 01 03 05 HEADER VER=00 McuConf LEN 03 CHK 55 AA 00 02 00 01 04 06 HEADER VER=00 McuConf LEN 04 CHK 55 AA 00 10 00 37 010713020004000000140A020004000001ED0C020004000000610D02000400000011140200040000001409040001010B020004FFFFFF3D 98 HEADER VER=00 Unk LEN 010713020004000000140A020004000001ED0C020004000000610D02000400000011140200040000001409040001010B020004FFFFFF3D CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 06 00 08 01160B1012321C03 A2 HEADER VER=00 Unk LEN bOk=1 22/11/16 18:50:28 CHK 55 AA 00 06 00 08 01160B1012321C03 A2 HEADER VER=00 Unk LEN bOk=1 22/11/16 18:50:28 CHK 55 AA 00 06 00 08 01160B1012321C03 A2 HEADER VER=00 Unk LEN bOk=1 22/11/16 18:50:28 CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK 55 AA 00 05 00 01 00 05 HEADER VER=00 Unk LEN CHK And see the stripped down version to what might be interesting: Code: text Expand Select all Copy to clipboard TX pin: (bootup sequences) **All defaults** (I suspect defaults are not transmit to TuyaMCU, you can see the TX data is shorter) Unit: C Temp report: 120 min Humidity report: 120 min Temp sensitivity: 0.6C Humidity sentitivity: 6% Temp min/max: 0C - 39C Humidity min/max: 20% - 60% // nothing Temp report: 1 min      (these options manage wifi wake frequency for reporting == battery use) Humidity report: 1 min 55 AA 00 10 00 12 010212020004000000011102000400000001 55 HEADER VER=00 Unk LEN 010212020004000000011102000400000001 CHK Temp report: 2 min Humidity report: 3 min 55 AA 00 10 00 12 010212020004000000031102000400000002 58 HEADER VER=00 Unk LEN 010212020004000000031102000400000002 CHK Temp report: 5 min Humidity report: 8 min 55 AA 00 10 00 1F 01041102000400000005120200040000000809040001001402000400000006 9D HEADER VER=00 Unk LEN 01041102000400000005120200040000000809040001001402000400000006 CHK ** Changing all the other options ** Unit: F Temp sensitivity: 0.4C Humidity sensitivity: 3% Temp min/max: 1.9C - 36.7C Humidity min/max: 23% - 57% 55 AA 00 10 00 47 01091402000400000003090400010111020004000000780D0200040000001712020004000000780B020004000000130A0200040000016F0C020004000000391302000400000004 E1 HEADER VER=00 Unk LEN 01091402000400000003090400010111020004000000780D0200040000001712020004000000780B020004000000130A0200040000016F0C020004000000391302000400000004 CHK Unit: F Temp sensitivity: 3.6F   (probably transmit 2.0C - NOTE: UI CHANGED TO F AFTER LAST BOOTUP) Humidity sensitivity: ??  (I forgot to write down what I set... it might be 20%, or maybe I didn't change it and it's still 3%, or something else!) Temp min/max: -3.1F - 120.7F  (probably transmit -19.5C - 49.3C) Humidity min/max: 17% - 97% 55 AA 00 10 00 37 010713020004000000140A020004000001ED0C020004000000610D02000400000011140200040000001409040001010B020004FFFFFF3D 98 HEADER VER=00 Unk LEN 010713020004000000140A020004000001ED0C020004000000610D02000400000011140200040000001409040001010B020004FFFFFF3D CHK It seems there is a packet that I was not yet aware of, most likely again with simple fnId typeId Length Data format. I will now look if I can parse it btw, thanks! You are really helping us discover new data formats. Dodano po 2 [minuty]: Let us compare: Temp report: 1 min Humidity report: 1 min VS Temp report: 2 min Humidity report: 3 min See two packets below: 010212020004000000011102000400000001 010212020004000000031102000400000002 Hmm it seems we can clearly see what has changed. Futhermore... isn't 0x04 here the length of data given? 4 bytes -> 00 00 00 02 02 00 04 00 00 00 02 id: 11 type: 02 (value) length: 00 04 4 bytes of data: 00 00 00 02 Dodano po 14 [minuty]:Full packet in question: 55AA0010001201021202000400000003110200040000000258 Dodano po 7 [minuty]:It really looks like a standard Status Data Unit packet with some extra bytes before first Status Data Unit section: Dodano po 16 [minuty]:I am not sure what those 2 bytes are.... but if I skip them... but if I skip them, I get correct reading in my tool...

TurkeyMan · Answer

The 2 bytes `01 02`?
Well there's 2 variables that follow, so I'd hazard a guess the second 02 byte is the number of variables to expect...?

Added after 4 [minutes]:

Yeah, that seems to track from the other examples. It starts 02 with just temp/humidity timer, and then increases to 7-8 items when I start setting all the things.
The 01 is constant in all of the packets, so hard to know about that...

p.kaczmarek2 · Answer

Maybe you are right, I haven't considered yet such possibility.

I didn't consider it, because anywhere you look, the number of variables is not specified anywhere, they just check the packet length to see if there is any more data left in the packet to parse...

It's strange they suddenly changed their standard.

Futhermore, see that:

Even the official docs does not specify anything like "number of data unit registers" after the "length of the packet".

TurkeyMan · Answer

To be fair though, the official docs don't say anything about those bytes... looks like they shouldn't be there at all?

p.kaczmarek2 · Answer

Well, I would also say they shouldn't be there after all, but maybe this packet is a modified version, after all, it has a 0x10 identifier and not the default one.

Still, now that we know it's format, it should be possible to send such a packet from OpenBeken as well, to configure the device.

Ok, is there anything else we need to know?

I need to deal with something else for now, but when I come back, I will plug the remaining 0x10 packets into my tool and see what they say.

TurkeyMan · Answer

There's nothing else that I'm aware of. It'll be interesting to see if your tool sees any other comms.
The only return values I can imagine are temp, humidity, battery level. There's not anything else to report.

p.kaczmarek2 · Answer

There are some communications related to MCU configuration (reset/pairing mode) etc but I don't think they are needed for OBK

TurkeyMan · Answer

Are you sure? Is it possible that the weird protocol is the result of a request for that protocol given at bootup?

Added after 1 [minutes]:

TODO: make your protocol parsing app into a webapp then we can more easily crowd-source unknown comms without spending your time on the task.

p.kaczmarek2 · Answer

I had this idea some time ago, but VUE/javascript is not as easy for fast development like C# for me. So, are we trying to convert this device to OpenBeken now?

TurkeyMan · Answer

Oh, totally agree. Web is the worst dev environment ever conceived by man, and I still can't understand why it's taken over the world.

We can convert it if you think we have all the data. Do you have a firmware update that can send the startup messages correctly?

Added after 1 [minutes]:

Is there a feature in OBK which will log any unknown packets for analysis?

Added after 4 [hours] 9 [minutes]:

Did you see any messages from wifi -> tuya that we didn't understand? Those are the messages that we can't diagnose anymore after the device is flashed.

TurkeyMan · Answer

How can I take a copy of existing firmware to I can restore the factory firmware if I need to tame more measurements?

TurkeyMan · Answer

How is this going? Is there an update which includes all the messages we learned? Shall I try and flash it now?
I guess there needs to be some sort of configuration UI to include the data that's sent to TuyaMCU too, how will that work do you think?
What kind of device configuration will tell the capabilities of the device, and what set of messages or config options should be relevant?

p.kaczmarek2 · Answer

Hello, sorry for late reply. I must have forgot about this topic.
For flashing, use hid_download_py.
Taking copy of firmware:


python uartprogram nousp4byhiddownloadpy.bin -d com10 -r -s 0x0 -l 0x200000
pause

Change com port to yours...
Writing our firmware:


python uartprogram ./OpenBK7231N_QIO_1.15.140.bin --unprotect -d com15 -w --startaddr 0x0
pause

Feel free to flash OpenBK now, we will try to support this device. We will write a config for that in autoexec.bat. For, you'll have to write commands for that.

Have you looked into other TuyaMCU topics? Like here?
OpenBK7231T for Hiking DDS238-2 Smart Meter

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

TurkeyMan · Answer

I had a thought; since the Tuya seems to control the power to the wifi module, it only powers it up to send an update every 2 hours... how will this work?
Doesn't MQTT work by polling the device? Or does the device report updates to the server? If HomeAssistant polls for an update, chances are that the device is turned off.
Also, after flashing, I wonder how I will configure it if the Tuya turns it off? I need to be able to login and configure the device before it's generally working...

TurkeyMan · Answer

I'm trying to flash this one today, but it seems I've hit a roadblock... it just always fails with "Cannot get bus".
I have a theory though; since powering 3.3V also powers the Tuya which starts a very noisy chatter; what stops the comms with the wifi module from being interfered by the Tuya?
I feel like I need to remove the Tuya somehow in order to isolate the wifi module from the comms circuit... but it's all tiny SMD parts, which I have no skills or tools to interface.

Added after 58 [minutes]:

Yeah, I can't work out what to do here... the wifi module's 3.3 is connected to what looks like a transistor, which connects back to a pin of the Tuya; so it seems the Tuya enables an IO pin which powers the wifi module on demand.
If I power the mainboard's 3.3V rail, the Tuya fires up, and then when that's happening, it fires up the wifi module, but they're chattering so I can't interrupt the wifi module's boot process to do a flash when the Tuya is in communication.
I thought I could try and power the 3.3V pin of the wifi module on the down-stream side of the transistor and that would isolate the wifi module from the rest of the board, but that doesn't seem to work; there's enough circuitry that the rest of the board gets some power and affects things when I breakout from the wifi module directly...

If I try and flash the chip using the breakout wires seem here, it still doesn't work.

p.kaczmarek2 · Answer

Your assumptions are basically correct.

There are few things to note:
- TuyaMCU decides when to power WiFi module, so for flashing you'd have to power it manually
- there are two flashing headers on the board (for WiFi and for TuyaMCU), as you correctly noted
- TuyaMCU communication with WiFi will interfere with programming

There are multiple approaches you can take here:
a) desolder whole WiFi module and just power from an external 3.3V LDO, just connect RX and TX and repower while "getting bus", it's works, no external resistors needed
b) cut traces between WIFI module and MCU, power WiFI module from 3.3V LDO external directly, flash (repower while "getting bus")
c) find datasheet of the MCU, determine whether it has a RESET pin, if it has, put the MCU into RESET state (by shorting it's RESET to ground?), and then power WiFi module from external 3.3V and flash
d) you can of course also desolder whole MCU....
e) if those tracks don't go to MCU directly (but through resistors):

you could just desolder resistors..

The following video (at the given timestamp) shows how I desolder SOIC chips at ease: https://youtu.be/JCqq-gn-X2c?t=187
NOTE: the following video will get an English audio version soon

The basic tools required for soldering operation are soldering iron, extra flux and extra pb solder. You can train on scrap boards in order to get it right, don't try first time on your device.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

TurkeyMan · Answer

Okay, I flashed this device now. I removed the resistors R3, R4 to break the TX/RX lines from the Tuya and I was able to flash.
It's difficult to configure the device now, because the Tuya only turns it on for a few moments... so I've powered the CB3S separately for now to keep it on.
We recorded the log data above, how do we configure the device to understand all the messages we discovered?

p.kaczmarek2 · Answer

Please consult TH06 topic: Do you have a firmware backup for analysis? Here's a basic config to try for your device: Code: text Expand Select all Copy to clipboard startDriver TuyaMCU startDriver NTP // dpID 1 is temperature div 10, so 288 means 28.8 setChannelType 1 temperature_div10 linkTuyaMCUOutputToChannel 1 val 1 // dpID 2 is % humidity (no division) setChannelType 2 Humidity linkTuyaMCUOutputToChannel 2 val 2 Save as autoexec.bat on LittleFS, reboot, wait for NTP to get network.... also you might need to make sure you have MQTT connected.

TurkeyMan · Answer

No, I don't have a backup...
I tried that particular script from that thread, it doesn't work. dpID 1/2 report no data. Could it be that the 00 version is not supported? Or those unknown message types?
What do I need to analyse? I recorded comprehensive tuyamcu comms above... surely we have everything? How do we plug the messages discovered in those comms into the configuration?

Also, I updated the OP, but it's pending moderator approval for the edit apparently...

p.kaczmarek2 · Answer

Can you post a screenshot from your main page? What do you have in the logs? I have checked parsing of your packets on windows and it gets the 285 value correctly - 28.5C:

TurkeyMan · Answer

I'm trying to make progress on this. It doesn't seem to want to communicate with the Tuya... maybe it's because how I'm powering it?
I'm powering the device's main VCC, which powers the Tuya, but under normal operation, the Tuya turns the wifi module on for a moment from time-to-time to allow it to report, then off again. I can't work out when the device is powered, and I can't intercept it fast enough to do any config or tests, so I also power the wifi module directly at the same time as the mainboard.
I'm not sure if applying power to the main board and to the wifi module both directly is going to cause some problem with the Tuya... I'm not sure why it would... but when I power it this way, the wifi module boots up, but it shows no communications.

Maybe it would be useful to make that UART sniffer you described in another thread?
I see there is "UART Tool", on the main menu; when I choose that, it looks like I can type some ascii and transmit over the UART(?), but it doesn't seem that it logs any incoming communications.
Perhaps improve that bit of software so it logs all RX bytes to a panel in the webpage, and maybe also allow to transmit hex rather than ascii? Then I can at least watch the comms, and I could even fabricate unsupported Tuya packets and send them.

Added after 58 [seconds]:

Also, we need a way to transmit the time to the Tuya... I can start NTP, but we need some way to know when the NTP init receives a response, and at that time, we need to send the time message to the Tuya...

Added after 2 [minutes]:

Oh, also, i noticed the "Home Assistant Configuration" automatically populates with config for relays and lights, but in this case where I have 2 read-only values, it doesn't attempt to populate the home assistant config with anything at all...
Do you know what should go in that home assistant config to advertise these 2 values to HA? How is that config structured?

Added after 9 [minutes]:

I think I've just exposed another issue...
I watched the wifi module's VCC on a scope, so I can see when Tuya supplies power to the wifi module. What I notice is, it powers the device for a few seconds, but OBK doesn't have time to boot up before it cuts the power again. This might be a problem!

Is there any way OBK can be optimised for faster boot time? It does seem to take a weirdly long time to boot.
I don't see why a tiny linux running almost nothing should take more than 1s to boot up, but it seems to take 15-20 seconds generally in my case here.

p.kaczmarek2 · Answer

It is not 15-20 seconds to boot, it's 15-20 seconds to connect to WiFI. It boots way faster.

I think that you need to start a tmSensor driver as well, because it will send a message to TuyaMCU saying "I am here, don't turn me off yet!"

See updated config:


startDriver TuyaMCU
startDriver NTP
startDriver tmSensor
// dpID 1 is temperature div 10, so 288 means 28.8
setChannelType 1 temperature_div10
linkTuyaMCUOutputToChannel 1 val 1
// dpID 2 is % humidity (no division)
setChannelType 2 Humidity
linkTuyaMCUOutputToChannel 2 val 2

Use the config above. Remove the jumper to VCC. This will only work if the WiFi module is started by TuyaMCU. After that, you will have about 90 seconds time online. This is because "tmSensor" sends the correct packets to TuyaMCU and tells it to keep it online. That time should be enough to get humidity and temperature results to Home Assistant.

I can make an UART logger, if that's needed.

HA discovery does not include TuyaMCU fields yet.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

TurkeyMan · Answer

That didn't seem to help. What is tmSensor?
The device stays on for about 15 seconds total from power on, just long enough to boot and show the webpage for about 3 seconds on one attempt, then turns off.
It doesn't show any readings from the Tuya in that time.
Most of the time it doesn't fire up fast enough before it cuts power.

Is there any way to speed up the wifi connection? Can the wifi driver be started earlier?

Quote:
HA discovery does not include TuyaMCU fields yet.

I'd rank that pretty high priority

[BK7231N] Tuya Temperature & Humidity Monitor: Teardown, Hackability & Features Explained

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Post #20

Post #21

Post #22

Post #23

Post #24

Post #25

Post #26

Post #27

Post #28

Post #29

Post #30

Topic summary