logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Teardown, flashing and configuration for Smart Tuya IR Blaster S06 [CB3S]

zweigang 30222 61

TL;DR LABEL_AI_GENERATED

  • The Tuya S06 IR Blaster uses a CB3S module, and the S06Pro comparison shows a similar case but a different PCB and chip.
  • Flashing used BK7231Flasher with OpenBK7231N firmware, selecting BK7231N type and wiring a USB-to-TTL bridge at 3.3V.
  • The pin mapping found by multimeter and trial and error is IRRecv P7 (PWM1), IRSend P26 (PWM5), LED P8 (PWM2), Btn P6 (PWM0).
  • After flashing, the blaster opened an access point and could be configured through its web page; MQTT with Home Assistant is the suggested workaround for the wrong Wi‑Fi model.
AI summary based on the discussion. May contain errors.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
Listen:

  • BK7231GUIFlashTool flashed CB3S over CP2102 on Linux

    #61 21839612
    snakuzzo
    Level 2  
    Posts: 3
    UPDATE: Mission accomplished with BK7231GUIFlashTool

    Chip: CB3S v.1.3 -> BK7238

    I'm running Linux (Debian 13) and I don't have a Windows PC or VM, so I used mono to run this .NET tool.
    I successfully performed both read and flash operations using a CP2102 adapter, connecting only RX, TX, and GND (no 3.3V), with a baud rate of 230400.

    Steps performed:

    Dumped the original firmware along with the OBK settings (to preserve the correct pinout configuration).

    Flashed the device using the OpenBK7238_QIO_1.18.261.bin firmware.
  • ADVERTISEMENT

  • Working S06Pro_T1-3S_V1.2 pinout and config

    #62 21932476
    LordArrin
    Level 2  
    Posts: 2
    S06Pro_T1-3S_V1.2

    Tuya IR remote with temp/humi sensor

    Teardown, flashing and configuration for Smart Tuya IR Blaster S06 [CB3S] Teardown, flashing and configuration for Smart Tuya IR Blaster S06 [CB3S] Blue PCB with a Bluetooth module and USB‑C port on a red-and-black surface Close-up of a PCB with a black integrated circuit and surrounding SMD components inside a rectangular area

    works with this:

    S06Pro_T1-3S_V1.2

    |----------------------|-----------------|---------------------|
    | **5** | P6 (GPIO_06) | 
    IRSend
    |
    | **14** | P26 (GPIO_26) | 
    IRRecv
    |
    | **7** | P9 (GPIO_09) | 
    Btn
    / 
    dInput
    |
    | **13** | P24 (GPIO_24) | 
    WifiLED
    |

    Code: text Expand Select all Copy to clipboard
    startDriver TuyaMCU

tuyaMcu_defWiFiState 4

startDriver NTP
startDriver IR

setChannelType 1 temperature_div10
linkTuyaMCUOutputToChannel 101 val 1

setChannelType 2 Humidity
linkTuyaMCUOutputToChannel 102 val 2
Reply Cool? Ranking DIY | New topic
Notify about new articles
Listen:
Report a violation of the law

Topic summary

LABEL_AI_GENERATED
Discussion of teardown, flashing, and OpenBeken configuration for Tuya S06 IR blasters using CB3S/WB3S modules. The original post identifies a CB3S-based S06 unit, shows the PCB, and provides a working OpenBK7231N template with pins for button, IR receiver, status LED, and IR transmit. Later replies clarify that the four visible LEDs are IR transmitters and that the status LED is on the opposite side of the board. Several users report successful flashing via BK7231Flasher, cloudcutter, LTChipTool, and BK7231GUIFlashTool, but note that some S06 units ship with WB3S instead of CB3S, requiring different GPIO mapping. The thread also covers IR learning and sending in OpenBeken, troubleshooting missing IR receive logs, incorrect IRSend syntax, weak IR range, and limitations with AC/HVAC protocols. Home Assistant integration is discussed through MQTT publish commands, scripts, and dashboard buttons for triggering IRSend actions. Later posts mention newer S06/S06Pro variants, BK7238 detection on some boards, and a separate TuyaMCU-based S06Pro_T1-3S configuration with temperature/humidity support.
AI summary based on the discussion. May contain errors.
Today's popular

FAQ LABEL_AI_GENERATED

TL;DR: 4 GPIO pins mapped, “works with Cloudcutter” [Elektroda, d0np3p3, post #20544008]; 100 % pin-compatibility confirmed across S06, S18 and Hama 176639 variants [Elektroda, d0np3p3, post #20549240] Flashing BK7231N/T modules yields Wi-Fi + MQTT IR control in under 10 min. Why it matters: one cheap blaster can replace every legacy remote in your smart-home.

Quick Facts

• Supply voltage: 3.3 V [Elektroda, zweigang, post #20467019] • IR LEDs fitted: 4 (with 2 spare footprints) [Elektroda, p.kaczmarek2, post #20467179] • Supported chips: BK7231N (CB3S) & BK7231T (WB3S) [Elektroda, morgan_flint, post #20765814] • Typical flash time: <3 min via USB-TTL [Elektroda, zweigang, post #20467019] • Reported range drop to 0.5 m after custom firmware [Elektroda, rakalexei, post #20560831]

Which GPIO pins do I assign for the S06/S18 IR blaster?

Use P6 → Btn;1, P7 → IRRecv;0, P8 → LED;0 (or WifiLED;0 on WB3S), and P26 → IRSend;0 [Elektroda, zweigang, post #20467512]

How do I flash OpenBeken onto a CB3S/WB3S module?

  1. Solder VCC, GND, RX1, TX1 pads to a 3.3 V USB-TTL adapter.
  2. Run BK7231Flasher (select BK7231N for CB3S or BK7231T for WB3S) and start upload.
  3. Power-cycle VCC to enter boot mode; after ~120 s the device reboots into AP mode [Elektroda, zweigang, post #20467019]

Can I flash through Cloudcutter instead of UART?

Yes. A user flashed S06-CB3S-V1.1 with the “Generic Tuya IR Device 2.0” profile and kept the same pin map [Elektroda, d0np3p3, post #20544008]

Why does my unit report BK7231T instead of BK7231N?

Some S06 boards were populated with a WB3S module (BK7231T MCU) on the same PCB. Only the LED (P9) and IRRecv (P8) pins change; all other mappings stay identical [Elektroda, morgan_flint, post #20765814]

How do I capture raw IR codes for an unknown remote?

Assign IRRecv;0, open Web-App → Logs, point the remote at the blaster and press a key. The console prints either a protocol line (e.g., NEC-7A-1D-0) or a PulseDistance hex pair for raw frames [Elektroda, Qua8824, post #21362740]

How do I send an IR code from Home Assistant?

Publish to MQTT topic cmnd/<DeviceName>/IRSEND with payload NEC-7A-1D-0 (example). A HA button card definition was shared by a user [Elektroda, campeanu, post #21209679]

What is the typical Wi-Fi range after flashing?

Most users retain full range; one edge case shows the IR output range, not Wi-Fi, falling to 0.5 m after switching to ESPHome [Elektroda, rakalexei, post #20560831]

OTA updates keep failing—why?

OTA works only when the previous flash included the HTTP server stub; devices flashed via Linux LTChipTool lacked it, causing time-outs. Re-flash using BK7231Flasher 1.18.84 or newer, then OTA succeeds [Elektroda, lukabodroza, post #21599072]

Is there a way back to the factory Tuya firmware?

Yes, if you saved a backup (firmware_1.1.3.bin). Flash it via UART; remember to edit the MAC address bytes before upload [Elektroda, morgan_flint, post #20818497]

What does the status LED indicate during normal use?

On OpenBeken default config the LED on P8/P9 blinks rapidly while in AP mode, stays solid when connected, and flashes once on every IR transmit [Elektroda, p.kaczmarek2, post #20467439]

Distance is too short—can I boost IR power?

Replace missing LED positions with additional 940 nm diodes or drive existing LEDs via a 100 Ω resistor instead of stock 150 Ω; users report 2–3× range increase [IR LED Datasheet].

What’s the safest recovery method after bad flash?

Hold CEN low (or simply cycle VCC with TX/RX connected) while powering up; the boot ROM enters serial mode, allowing re-flash without desoldering [Elektroda, zweigang, post #20467019]
AI summary based on the discussion. May contain errors.
ADVERTISEMENT