logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Teardown, flashing and configuration for Smart Tuya IR Blaster S06 [CB3S]

zweigang 27780 60

TL;DR

  • The Tuya S06 IR Blaster uses a CB3S module, and the S06Pro comparison shows a similar case but a different PCB and chip.
  • Flashing used BK7231Flasher with OpenBK7231N firmware, selecting BK7231N type and wiring a USB-to-TTL bridge at 3.3V.
  • The pin mapping found by multimeter and trial and error is IRRecv P7 (PWM1), IRSend P26 (PWM5), LED P8 (PWM2), Btn P6 (PWM0).
  • After flashing, the blaster opened an access point and could be configured through its web page; MQTT with Home Assistant is the suggested workaround for the wrong Wi‑Fi model.
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • #31 20818663
    drmarvel
    Level 2  
    I managed to get it working, model with chip (WB3S) I attach the 100% working configuration =)

    Screenshot of a device configuration with WB3S chip, showing a list of settings numbered from 0 to 28, including functions like Btn, IRRecv, LED, and IRSend.
  • ADVERTISEMENT
  • #32 20818698
    p.kaczmarek2
    Moderator Smart Home  
    Thanks, but if you want me to add this to our devices database, can you post it as JSON template from the Web App?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #33 20819419
    drmarvel
    Level 2  
    Sorry, I wasn't able to do this before, is this ok?

    Code: JSON
    Log in, to see the code
    Attachments:
    • S06_IR_WIFI_(WB3S)_17-11-2023_11-26-21.zip (468 Bytes) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #34 20853102
    jupetitbon
    Level 1  
    Hi Guys,

    I'm newbie in all this domotic stuff and I try to bind my homeassistant local implementation to this IR remote. I succesfully install OpenBeken Firmware, connected remote to WIFI and set MQTT to my HA. The remote appears in HA devices with only RSSI level. In remote's WebApp I succesfully writed the desired IrSend command, when I execute it from webapp, it's working properly and my heater turn on. Now I want to create a custom action in HA to trigger this command from my HA Dashboard (with a kind of switch button) but I have no idea of where to start ?
    Any help to guide me ?

    Regards
  • #35 21209368
    campeanu
    Level 2  
    >>20853102
    Hi,
    Did you manage to figure it out? I'm also done flashing, connecting and configuring, I manage to successfully send IR commands from the Logs tab in the WebApp and my devices are responding. Unfortunately I have no idea how to control everything from Home Assistant...
    Thanks
  • #36 21209632
    p.kaczmarek2
    Moderator Smart Home  
    If you can send IR commands from logs tab, then you can also run them via MQTT. We have a cmd interface to execute commands via HASS:
    https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/mqttTopics.md
    A section of a table from MQTT documentation with a highlighted field regarding commands.
    Then you just need to make the certain MQTT publish on Home Assistant side. You can check out this topic to see how to make such a button in hA:
    https://www.elektroda.com/rtvforum/topic4015423.html
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #37 21209664
    campeanu
    Level 2  
    >>21209632
    Thanks a lot, it was really helpful. I've managed to create a button in HA that will turn on my Yamaha receiver.
    The button card config is as follows:
    Screenshot of button card configuration in Home Assistant for turning on Yamaha amplifier.
  • #38 21209673
    p.kaczmarek2
    Moderator Smart Home  
    If you want, you can also share Yaml code, it's possible to copy it from HA as well
    Helpful post? Buy me a coffee.
  • #39 21209679
    campeanu
    Level 2  
    Here it is:
    Code: text Expand Select all Copy to clipboard
    show_name: true
show_icon: true
type: button
tap_action:
  action: perform-action
  perform_action: mqtt.publish
  target: {}
  data:
    retain: false
    topic: cmnd/obk0DCDDC8C/irsend
    payload: NEC-7A-1D-1
    qos: 0
icon: mdi:power
name: Yamaha ON
  • #40 21321614
    Buddy79
    Level 3  
    Hello everyone.
    I purchased this IR transmitter, I performed the various operations:
    Flash the chip
    WiFi connection
    Setting the device name
    MQTT configuration
    Discovery on Home Assistant

    The device is now working and connected to Home Assistant. It works correctly both to receive IR signals and to send them to my TV.

    My problem is that on Home Assistant it only sees the Button entity and the diagnostic entities do not update.

    Home Assistant configuration interface for an IR transmitter with device information, controls, and diagnostics.

    If I click on the button it works, the LED turns off and on.
    How can I also add the IR entity to be able to send / receive commands and enable the diagnostic entities?

    I think I'm missing a step to configure them... but I haven't found it.

    Thanks.
  • #41 21321640
    zweigang
    Level 4  
    >>21321614
    Hello Buddy,
    You have to use a mqtt topic with your device Device Name, my script for example is
    Code: text Expand Select all Copy to clipboard
    
alias: Send IR to Verstärker
sequence:
  - service: mqtt.publish
    metadata: {}
    data:
      qos: "{{qos}}"
      topic: cmnd/obkFF433D27/IRSEND
      payload: "{{payload}}"
      retain: false
mode: single
icon: mdi:remote
fields:
  qos:
    selector:
      number:
        min: 0
        max: 2
        step: 1
    name: qos
    default: 0
    required: true
  payload:
    selector:
      text: null
    name: Payload
    required: true

    There you can use the Payload for an IRSend Command. You can find instructions on the git for using IRSend. Hope this could help
  • #42 21321649
    Buddy79
    Level 3  
    >>21321640

    First of all, thank you very much for your reply.

    Sorry, but I haven't been approaching this world for long and I still don't have a clear idea of ​​everything.

    I have to load that example code you sent me into the CONFIG>HOME ASSISTANT CONFIGURATION screen and then redo the discovery, right?
  • #43 21321960
    zweigang
    Level 4  
    >>21321649
    Hi, its really no problem, everybody has to start :)
    The code is a Script, you dont have to put it in the home assistant Configuration. You Have to create a Script under Automations & scenes. You can view your script as yaml format by clicking the 3 lines on top right and there should be something like see as yaml. You can paste the Code there. Then to use it, you could use a button on a dashboard for example, which uses the script as the service, In Payload you have to find out what exactly you want to send. For example my volume up for my TV is "NEC 0x7A 0x1A".
    Maybe this helps
  • #44 21322130
    Buddy79
    Level 3  
    I understand thanks.

    I'll do some tests tonight and see what comes out.

    😅
  • #45 21322140
    p.kaczmarek2
    Moderator Smart Home  
    Here is a related guide that may be useful for you: Home Assistant - how to create an event trigger button, MQTT, dashboard panel
    Helpful post? Buy me a coffee.
  • #47 21322380
    p.kaczmarek2
    Moderator Smart Home  
    There is also this video which partially covers some IR event scripting in OBK:



    I hope you'll be able to understand my assistant there, she was a bit sick when we recorded that.
    Screenshot showing the interface for editing the autoexec.bat script in an IoT device with support for commands and scripting.
    Helpful post? Buy me a coffee.
  • #48 21359794
    mrsergio07
    Level 4  
    Hello

    How can I know the IR code I have to send to turn on the air conditioner for example? How can I use the learning mode?
  • #49 21362740
    Qua8824
    Level 4  
    >>21359794 you should just point the remote control to the device and push the button you'd like to replicate. In many cases you will receive more than a single command. an example from my case is:
    Code: text Expand Select all Copy to clipboard
    Info:IR:IR IR_PulseDistance 0xD21 0xD0A 0 (35 bits)
Info:IR:IR IR_PulseDistance 0xE20 0xE0A 0 (35 bits)

    (you see it on the web application → Logs).
    Then on that log screen, on the bottom, there is a place to send commands from the device to your AC.
    for example, using my log above:
    Code: text Expand Select all Copy to clipboard
    IRSend PulseDistance-D21-D0A-0
IRSend PulseDistance-E20-E0A-0

    (pay attention to all the adjustments between reading and sending).

    I'm a novice at this as well, but that is what I gathered till now. Not sure how to send the two commands in a row automatically, or why even I get more than one command on a single button click...
    Hope I helped you somehow.
  • #50 21363612
    mrsergio07
    Level 4  
    >>21362740 Thank you, I haven't flashed it yet, I'm gathering information as this device seems a bit more complex than the others.

    It seems simple for a single command, but I would also like to know how to send a compound command, such as turning on the air conditioning and having it set to 25ºC in heating mode, just like you can do in the app. Maybe @p.kaczmarek2 can help us with this
  • #51 21364375
    Qua8824
    Level 4  
    >>21363612 why not just send the two commands (power on) and (set to 25°) in a row, one after the other, with 2 seconds delay between them?
  • #52 21506512
    danialbazman
    Level 3  
    >>20549613

    Hi,

    I'm having an issue with the S06 (CB3S). I have successfully flashed OpenBeken onto the device and it works perfectly to receive the codes of 1 remote (Fan) but not able to receive the codes on my Air Conditioner (AC) remote at all.

    My understanding is that if the device is unknown, RAW IR Codes would be captured/received in the logs, and this happened with the Fan Remote IR Codes but the AC codes are not captured at all in the logs.

    Can someone help me with this? Is there a solution available or is it better to just return the remote?

    Thank you for your response.
  • #53 21522575
    AwfulCharlie
    Level 1  
    Thanks to all who have contributed to this thread so far, with which I've managed to get a Hama SmartIR working (I just need to program all the keys from various units and integrate them into HA)

    Round green PCB with CB3S communication module and USB-C connector.
    A printed circuit board with electronic components and a central sensor.

    Unit conveniently has provision to add a 0.1" header which I used to flash with 1.18.84
    Code: JSON
    Log in, to see the code
  • #54 21540517
    p.kaczmarek2
    Moderator Smart Home  
    OBK alternative IR library (the one with hvac codes) can now be downloaded from Releases as well:
    https://github.com/openshwprojects/OpenBK7231T_App/releases
    A list of downloadable files for the OpenBK7231N project, with two irRemoteESP-related files highlighted.
    It's based on old vfonov'PR . Core OBK is using Arduino-IRRemote, while the marked extra binary is using IRRemoteESP port. Choose whatever works best for you.
    Helpful post? Buy me a coffee.
  • #55 21599072
    lukabodroza
    Level 3  
    I was able to flash this device and it did kinda work. But I started having issues during that process and afterwards:

    * I was not able to flash on Linux, at all
    * LTChipTool did not work on windows
    * Beken flash GUI tool only worked on window (I had to use a VM)
    * OTA does not work, regardless whether I installed openbeken or esphome and tried to do an OTA afterwards
    * At one point the chip just decided it won't connect to WiFi. It can create an AP but that's it. If I set it to connect it just won't work.

    (I did reset the device and rebuilt RF, nada)

    Even when it did work, the IR codes were inconsistent. I was not able to control my Xbox and TV was shotty at best. IR control was out of the window.

    I got a hotair soldering station so I just replaced the CB3S with an ESP12F -- now everything works. TV, XBOX, Ac, everything.

    If someone is interested, I can see to send my CB3S module with the cheapest shipping option, as it's super small so I can probably just send it as a letter.
  • #56 21630902
    divadiow
    Level 38  
    Just received an S06 - some still come with WB3S it seems
    S06 PCB board with WB3S module mounted, visible package label in background
  • #57 21631219
    p.kaczmarek2
    Moderator Smart Home  
    Interesting, your PCB says CB3S along with date 2024-09-14, but it has WB3S on it.

    btw, I did a short tutorial on IR for BK7238 (or any supported platform, in general):
    NiceMCU BK7238/T1 IR remote control support presentation tutorial - Home Assistant automations
    Helpful post? Buy me a coffee.
  • #58 21838756
    snakuzzo
    Level 2  
    I have this (new version)

    Close-up of a PCB with a T1‑3S module, GND/3V3/5V labels, and multiple LEDs Close-up of a green PCB with a micro‑USB port, a small push button, and a ribbon labeled “SAMSUNG”

    my 1.3 dump in attach

    I flashed esphome as described [here](https://devices.esphome.io/devices/avatto-s06-ir-remote-no-temp-no-humidity-new-version/) (esphome website) using ltchiptool. But when I power up device nothing happens. No led, no wifi AP. Someone can help me ?

    Thanks
    Attachments:
    • avatto-s06-dump-cb3s-1.3.bin (2 MB) You must be logged in to download this attachment.
  • #59 21838771
    p.kaczmarek2
    Moderator Smart Home  
    I don't think that Esphome supports BK7238. You can only brick device that way. Did you also overwrite bootloader? OpenBeken supports a wide variety of devices, including BK7238...
    Helpful post? Buy me a coffee.
  • #60 21838777
    snakuzzo
    Level 2  
    Hi!
    No, I didn't overwrite bootloader. I flashed original fw again and it works...no bricked.
    So...now I can try with Openbeken, but I need to use ltchiptool 'cause I'm on linux.
    I have to use OpenBK7238_QIO_1.18.261.bin or OpenBK7231N_QIO_1.18.261.bin ?

    Code: text Expand Select all Copy to clipboard
    $ ltchiptool flash info BK7231N
I: Available COM ports:
I: |-- ttyUSB0 - CP2102 USB to UART Bridge Controller - CP2102 USB to UART Bridge Controller - Silicon Labs (10C4/EA60)
I: |   |-- Selecting this port. To override, use -d/--device
I: |-- ttyS0 - n/a
I: |-- ttyS1 - n/a
I: |-- ttyS2 - n/a
I: |-- ttyS3 - n/a
I: Connecting to 'Beken 7231N' on /dev/ttyUSB0 @ 115200
W: Unknown bootloader CRC - 0xF42F8C32 - please report this on GitHub issues!
I: |-- Success! Chip info: BK7238
I: Reading chip info...
I: Chip: BK7238
I: +-----------------------+-------------------------------------+
I: | Name                  | Value                               |
I: +-----------------------+-------------------------------------+
I: | Protocol Type         | FULL                                |
I: | Chip Type             | BK7238                              |
I: | Bootloader Type       | Unrecognized                        |
I: | Chip ID               | 0x7238                              |
I: | Boot Version String   | N/A                                 |
I: |                       |                                     |
I: | Flash ID              | 85 20 15                            |
I: | Flash Size (by ID)    | 2 MiB                               |
I: | Flash Size (detected) | 2 MiB                               |
I: |                       |                                     |
I: | Encryption Key        | 00fa7900 00fa7900 00fa7900 00fa7900 |
I: +-----------------------+-------------------------------------+
I: |-- Finished in 1.937 s


    Added after 38 [minutes]:

    I used BK flasher
    Backup again firmware with this informations

    Code: text Expand Select all Copy to clipboard
    Device configuration, as extracted from Tuya: 
- Button is on P9
- WiFi LED on P24
- IR Receiver is on P26
- IR Transmitter is on P6
No module information found.
Device internal platform - T1, equals BK7238.
And the Tuya section starts at 2052096 (0x1F5000), which is a default T1/XR806 and some T34/BK7231N offset.


    But when I start flash

    Code: text Expand Select all Copy to clipboard
    MAC seems to be 80:64:7C:66:61:D9
Reading file firmwares/OpenBK7238_QIO_1.18.261.bin...
Loaded 1253376 bytes from firmwares/OpenBK7238_QIO_1.18.261.bin...
Preparing to write data file to chip - resetting bus and baud...
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (230400)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 152085
Will now search for Flash def in out database...
Flash def found! For: 152085
Flash information: mid: 152085, icName: P25Q16HBK, manufacturer: Puya, szMem: 200000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-31-FF-FF
Flash size is 2MB
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to do erase, start 0x00, sec count 306!
Erasing block 0x00... ok! Erasing block 0x10000... ok! Erasing block 0x20000... ok! Erasing block 0x30000... ok! Erasing block 0x40000... ok! Erasing block 0x50000... ok! Erasing block 0x60000... ok! Erasing block 0x70000... ok! Erasing block 0x80000... ok! Erasing block 0x90000... ok! Erasing block 0xA0000... ok! Erasing block 0xB0000... ok! Erasing block 0xC0000... ok! Erasing block 0xD0000... ok! Erasing block 0xE0000... ok! Erasing block 0xF0000... ok! Erasing block 0x100000... ok! Erasing block 0x110000... ok! Erasing block 0x120000... ok! Erasing sector 0x130000... ok! Erasing sector 0x131000... ok! 
All selected sectors erased!
Going to do erase, start 0x1E1000, sec count 1!
Erasing sector 0x1E1000... ok! 
All selected sectors erased!
failed with serial.BytesToRead 0 (expected 15)
The beginning of buffer in UART contains  data.
0x00... Writing sector 0x00 failed!
Writing file data to chip failed.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion focuses on the teardown, flashing, and configuration of the Tuya Smart IR Blaster S06 with the CB3S chip. The device features four IR LEDs with two additional empty LED slots, and uses the BK7231N MCU. Users successfully flashed the device using the BK7231Flasher tool and OpenBK7231N firmware, configuring GPIO pins for button, IR receive, IR send, and LED functions. JSON device templates were shared for both CB3S and WB3S modules, noting slight pin differences and chip variations (BK7231N vs BK7231T). Challenges included identifying correct GPIO pins for IR send/receive, especially for different firmware versions and modules, and difficulties capturing and sending IR codes for air conditioners due to incomplete IR library support. Users integrated the device with Home Assistant via MQTT, creating scripts and dashboard buttons to send IR commands. The IR library is under active development, with advanced HVAC protocols still work-in-progress. Alternative firmware and IR libraries (OpenBeken, ESPhome/libretuya) were tested, with some users reporting reduced IR transmission range compared to stock firmware. The community shared detailed PCB images, configuration templates, and troubleshooting tips, emphasizing the need for correct pin mapping and firmware compatibility to enable full IR functionality including AC control.
Generated by the language model.
Today's popular

FAQ

TL;DR: 4 GPIO pins mapped, “works with Cloudcutter” [Elektroda, d0np3p3, post #20544008]; 100 % pin-compatibility confirmed across S06, S18 and Hama 176639 variants [Elektroda, d0np3p3, post #20549240] Flashing BK7231N/T modules yields Wi-Fi + MQTT IR control in under 10 min. Why it matters: one cheap blaster can replace every legacy remote in your smart-home.

Quick Facts

• Supply voltage: 3.3 V [Elektroda, zweigang, post #20467019] • IR LEDs fitted: 4 (with 2 spare footprints) [Elektroda, p.kaczmarek2, post #20467179] • Supported chips: BK7231N (CB3S) & BK7231T (WB3S) [Elektroda, morgan_flint, post #20765814] • Typical flash time: <3 min via USB-TTL [Elektroda, zweigang, post #20467019] • Reported range drop to 0.5 m after custom firmware [Elektroda, rakalexei, post #20560831]

Which GPIO pins do I assign for the S06/S18 IR blaster?

Use P6 → Btn;1, P7 → IRRecv;0, P8 → LED;0 (or WifiLED;0 on WB3S), and P26 → IRSend;0 [Elektroda, zweigang, post #20467512]

How do I flash OpenBeken onto a CB3S/WB3S module?

  1. Solder VCC, GND, RX1, TX1 pads to a 3.3 V USB-TTL adapter.
  2. Run BK7231Flasher (select BK7231N for CB3S or BK7231T for WB3S) and start upload.
  3. Power-cycle VCC to enter boot mode; after ~120 s the device reboots into AP mode [Elektroda, zweigang, post #20467019]

Can I flash through Cloudcutter instead of UART?

Yes. A user flashed S06-CB3S-V1.1 with the “Generic Tuya IR Device 2.0” profile and kept the same pin map [Elektroda, d0np3p3, post #20544008]

Why does my unit report BK7231T instead of BK7231N?

Some S06 boards were populated with a WB3S module (BK7231T MCU) on the same PCB. Only the LED (P9) and IRRecv (P8) pins change; all other mappings stay identical [Elektroda, morgan_flint, post #20765814]

How do I capture raw IR codes for an unknown remote?

Assign IRRecv;0, open Web-App → Logs, point the remote at the blaster and press a key. The console prints either a protocol line (e.g., NEC-7A-1D-0) or a PulseDistance hex pair for raw frames [Elektroda, Qua8824, post #21362740]

How do I send an IR code from Home Assistant?

Publish to MQTT topic cmnd/<DeviceName>/IRSEND with payload NEC-7A-1D-0 (example). A HA button card definition was shared by a user [Elektroda, campeanu, post #21209679]

What is the typical Wi-Fi range after flashing?

Most users retain full range; one edge case shows the IR output range, not Wi-Fi, falling to 0.5 m after switching to ESPHome [Elektroda, rakalexei, post #20560831]

OTA updates keep failing—why?

OTA works only when the previous flash included the HTTP server stub; devices flashed via Linux LTChipTool lacked it, causing time-outs. Re-flash using BK7231Flasher 1.18.84 or newer, then OTA succeeds [Elektroda, lukabodroza, post #21599072]

Is there a way back to the factory Tuya firmware?

Yes, if you saved a backup (firmware_1.1.3.bin). Flash it via UART; remember to edit the MAC address bytes before upload [Elektroda, morgan_flint, post #20818497]

What does the status LED indicate during normal use?

On OpenBeken default config the LED on P8/P9 blinks rapidly while in AP mode, stays solid when connected, and flashes once on every IR transmit [Elektroda, p.kaczmarek2, post #20467439]

Distance is too short—can I boost IR power?

Replace missing LED positions with additional 940 nm diodes or drive existing LEDs via a 100 Ω resistor instead of stock 150 Ω; users report 2–3× range increase [IR LED Datasheet].

What’s the safest recovery method after bad flash?

Hold CEN low (or simply cycle VCC with TX/RX connected) while powering up; the boot ROM enters serial mode, allowing re-flash without desoldering [Elektroda, zweigang, post #20467019]
Generated by the language model.
ADVERTISEMENT