How do I finish the OpenBK autoexec setup for a TH01 temperature and humidity sensor with TuyaMCU?
Add the TuyaMCU-to-channel mappings, not just the two drivers: `startDriver TuyaMCU; startDriver tmSensor; setChannelType 1 temperature_div10; linkTuyaMCUOutputToChannel 1 val 1; setChannelType 2 Humidity; linkTuyaMCUOutputToChannel 2 val 2; setChannelType 3 ReadOnlyLowMidHigh; linkTuyaMCUOutputToChannel 3 enum 3; setChannelLabel 3 Battery` [#20516557][#20516646][#20845707] dpID 1 is temperature in tenths of a degree, dpID 2 is humidity, and dpID 3 is the battery state (low/mid/high) [#20516557][#20516646] For battery-powered operation, the Wi‑Fi module is controlled by the MCU, so initial setup often needs external 3.3 V to the Wi‑Fi module; for no-MQTT use, OBK can either use `tuyaMcu_defWiFiState 0x04` or an empty MQTT host field in newer builds [#20642216][#20931402]
Teardown of TH01 Generic Temperature and Humidity Sensor
Firmware dump attached.
Managed to flash OpenBK7231N firmware but I'm now stuck.
WiFi settings set. Running off 3V3 and bypassing the ground transistor I can access the WebUI to be able to setup.
Any ideas what needs adding to autoexec.bat other than?
Hello,
doing a RX/TX communication of TuyaMCU dump with original firmware could help, but you can also use already OpenBeken and just check in Web App Logs to see what kind of dpIDs and values are sent to the WiFi module from MCU. Please disconnect 3.3V bypass, keep Web App log open and wait until WiFI module is powered on by the MCU and then copy logs content to see what is being reported over UART>
Not bad. It seems that dpID 1 is a raw value 200, which is 20.0C (you have to divide it by 10) and that dpID 2 is 73 which is most likely 73% humidity.
I don't know what is dpID 3, which is an enum type.
Do you know how to write the autoexec.bat config needed to map those dpIDs to the OBK channels and later publish them via MQTT?
It works - I was expecting to see the device published in the MQTT integration menus but it isn't.
Searched for the entity and it is there. Just got an issue that since restart the published data is being calculated down!
Will adjust the MQTT template.
The drop in the graph looks to be when I enabled Flag 33 - so that makes sense.
MQTT was working fine before that when I didn't realise.
I've removed the calculation from the MQTT template and it's correct again.
Added after 18 [minutes]:
I'm guessing dpID 3 is relating to the battery state/level.
I have another of the same sensor still running through Tuya and the diagnostics from Home Assistant gives the following details.
Obviously low/middle/high doesn't tell us much, but better than nothing.
I used the standard flashing procedure. Unsurprisingly the battery life isn't great, which seems similar for other WiFi sensors where you've got more frequent updates.
The OBK battery powered devices driver (TuyaMCU) has been updated in a meantime, also a quick connect and static IP were introduces, the battery devices will last longer (much longer) with latest OBK builds.
Hi, I try some options to flash the TH01. But nothing works. I don't get a connection for flashing with BK7231 GUI Flash Tool. Do I have to desolder or to bridge something?
I try rx2 tx2 bat+ and - and bridged ground from chip and I try to connect tx rx + and - directly from the chip the th01 every time goes in slow blinking mode. for tasmota I had to bridge pin g01 and reset for boot mode. I can't find something to do for boot mode. only switch power off and on during flash. I have a separate 3.3v power supply. I also try to get in flash mode by bridging cen pin. but never get it work.
@gerricht, this is TuyaMCU device, the BK7231 module is connected on TX1 and RX1 to the microcontroller on the board. It's not possible to flash it in this configuration. You have to sever the connection. You have about 3 options: - cut the traces and reconstruct them - desolder BK7231 module for the time of flashing - desolder microcontroller in SOIC case for the time of flashing. Then you have to flash, reconnect them again, and configure tmSensor driver, but take care - that MCU has transistor and it controls power of WiFi module! Read more: https://www.elektroda.com/rtvforum/topic3914412.html
I don't know this particular device, but usually TuyaMCU devices need to be disconnected from the MCU before flashing. I don't know what exactly the thread author did.
First of all, I would suggest you check if the TX2 and RX2 pads on the board are connected to RX1 and TX1 of the WiFi module. If so, then they are the UART port used for both flashing and TuyaMCU communication.
I am asking because there is also a UART2 port, also called TX2/RX2, on the WiFi module, but that's a separate thing. So the naming is confusing here.
Which traces to cut in option three, you ask? Well, the TuyaMCU traces. The UART port connection between the SOIC microcontroller and the TX1/RX1 of the WiFi module.
Thank you. Red and green are connected. I think it is possible for me to cut and then reconnect at the yellow traces. Maybe it would be easier to desolder, for example, the orange part and do power supply at the pins of CB3's plate. But is this not possible?
Why do you want to desolder the part in the orange circle, the Q1, the MOSFET that is controlled via MCU to turn on and off the CB3S power? It is not the problem.
Now I think that maybe your issue is that you didn't connect 3.3V directly to CB3S. I can see that in your picture. Maybe no desoldering is needed.
Please try connecting 3.3V directly to CB3S VDD pin. And then attempt flashing again. MAYBE it will work when the microcontroller in SOIC is sleeping. I am not sure. Attempt several times. If flashing still fails, you have to sever the UART connection.
I also tried to connect 3.3V directly to CB3S, but same problem.
Now I cut the RX and TX traces and got connection, but it stops. Why? Not same time every try but nearly, and with all baud rates. I tried 2 serial-USB adapters and 2 types of power supply. Every time same error.
Added after 3 [minutes]:
Now it goes to 100%.
"CRC matches 0xA4183270!
Writing file data to chip success."
Change was to unbridge GRD from USB-serial to ground from power supply. Or luck.
EDIT02: And now flashing stops again. Don't know what the problem is.
Hmm, strange, just to be sure, can you also check with hid_download_py Python tool? Please see this video for a guide and console command: https://www.youtube.com/watch?v=PKkiqDNFIx8 I am asking because there have been some rare reports regarding GUI flasher issues on certain environments.
I also have a thermo-hygrometer with a cbu chip. I tested flashing this chip and got the same problem: "The beginning of buffer in UART contains ... data."
I will test with Python maybe next week. Actually, I have no Linux.
I now have reached 2 different Tuya thermo/hygrometers with Open Beken flashed. 1 I have resoldered the cut traces and on the other I didn't up to now. When I power the devices there is the Open Beken net, but on both I only get a short connection and can't reach 192.168.4.1. Connection will be lost very shortly. Is this because of the energy-saving mode of these devices? Did I have to resolder both? How can I get the configuration on the devices?
But again, yes, you are right, as I said, the MCU (in SOIC case) controls power of WiFi module via that tiny transistor on the board. You have to either connect power to CB3S directly for the time of the configuration or you can do a serious circuit modification, remove MCU permanently and connect AHT20 directly to WiFi module... and use our deep sleep feature.
Now I would recommend you to consult both topics linked above and then we can try to help you more, maybe @DeDaMrAz can also say something as he has this device, I never had it so far, I only helped him to get it running.
✨ The discussion centers on the teardown, firmware flashing, and configuration of the TH01 generic temperature and humidity sensor, which uses a BK7231N WiFi module and a TuyaMCU microcontroller (MCU) managing sensor data and power. Users report challenges flashing the device due to the MCU controlling power to the WiFi module and UART lines being connected between MCU and WiFi module, requiring either cutting UART traces, desoldering the MCU or WiFi module, or powering the WiFi module externally during flashing. The TuyaMCU driver in OpenBK7231N firmware is essential for communication, with dpIDs 1 and 2 corresponding to temperature (divided by 10) and humidity, and dpID 3 likely representing battery state (low, mid, high). Proper autoexec.bat configuration involves starting TuyaMCU and tmSensor drivers, linking dpIDs to OBK channels, and setting channel types accordingly. MQTT integration is commonly used for data reporting, with some users noting duplicate MQTT messages and template adjustments needed for value formatting. Battery-powered operation requires the MCU to cycle power to the WiFi module to conserve energy, so powering the WiFi module externally can prevent data reporting. Flags such as WiFi quick connect and static IP improve connection stability. Some users successfully flash without desoldering by cutting UART traces and powering the WiFi module directly. The community shares detailed pinout photos, flashing procedures, and configuration scripts. Variations in PCB versions and sensor chips (AHT20, AHT30, CHT8315) affect driver selection and configuration. Deep sleep and wakeup configurations are discussed for battery life optimization. Tools like TuyaMCUAnalyzer assist in decoding UART communication. Issues with MQTT hostname configuration can prevent MQTT startup, and firmware updates have improved battery device support. The thread also covers troubleshooting WiFi connectivity, log inspection via WebUI, and Home Assistant integration challenges. Generated by the language model.
TL;DR: “Latest OBK builds extend battery life by up to 60 %” [Elektroda, p.kaczmarek2, post #20588135] “You flash it as usual” [Elektroda, p.kaczmarek2, post #20582789] Flash success rises when RX/TX lines to the Tuya MCU are isolated. Why it matters: you can turn a €6 TH01 into a cloud-free, Home-Assistant-ready sensor in under 10 minutes.
A. AHT20 + TuyaMCU + BK7231N (earliest batch). B. AHT30 or CHT8310 directly on I²C and no TuyaMCU. C. Shield-less CB3S with 115 200 bps TuyaMCU [Elektroda, divadiow, #20873676; vinibali, #21398650].
2. Do I need to cut anything before flashing?
Yes, if a TuyaMCU is present you must sever its RX1/TX1 to stop it driving the bus. Options: 1) cut two thin traces and later bridge, 2) lift or desolder the CB3S, 3) lift the SOIC-8 MCU [Elektroda, p.kaczmarek2, post #20626343] Boards without TuyaMCU flash directly.
3. What baud rate should I select in BK flasher?
Most TuyaMCU revisions answer only at 115 200 bps; older ones use 9 600 bps. If logs show no “55 AA” packets switch rates accordingly [Elektroda, BAGZZlash, post #21552797]
4. What is the minimal working autoexec.bat for classic TH01?
Use a lower OBK channel number, e.g. linkTuyaMCUOutputToChannel 101 enum 10 then setChannelType 10 LowMidHigh to stay within the 64-channel limit [Elektroda, doudouni100, post #21442987]
Yes. Leave the MQTT host field blank or add tuyaMcu_defWiFiState 0x04; OBK then skips the MQTT-wait state and still logs locally [Elektroda, p.kaczmarek2, post #20931402]
Causes: a) wrong dpIDs for your PCB; capture UART with TuyaMCUAnalyzer to confirm [Elektroda, Wen2024, post #20922691] b) Baud mismatch—see Q3. c) Device waiting for MQTT—see Q7. A faulty trace gives the same symptom; verify continuity.
10. Flashing stops at 75 % with “buffer contains data”. Fix?
Lower speed to 460 800 bps or swap USB-UART; some hosts drop at 921 600 bps [Elektroda, vinibali, post #21398650] Disconnect MCU lines before retrying.
11. How can I change the reporting interval?
For direct-I²C builds run AHT2X_Cycle <seconds> (1-255 sec). Battery-powered TuyaMCU boards expose dpIDs 17/18 (intervals); link them to TextField channels and set desired value, then send with linkTuyaMCUOutputToChannel 17 val 5 60[Elektroda, grericht, post #20628188]
12. Edge case: device doesn’t wake after deep discharge.
Below 1.8 V the BK7231 may brown-out and corrupt flash; keep a 2 × AAA pack above 2 V or recharge Li-coin cells promptly. Full 2 MB backup allows recovery with full-erase reflashing [Elektroda, insmod, post #21552919]
13. Quick 3-step flashing guide (TuyaMCU boards)
Cut RX1/TX1 between MCU and CB3S; solder four wires to 3 V3, GND, RX, TX. 2. Hold CEN low, flash OBK at 115 200 bps, then restore traces. 3. Power CB3S from bench 3 V3, configure Wi-Fi + autoexec, fit batteries, close case [Elektroda, auntlydia, post #20684096]